{"id":"CVE-2026-113584","kind":"vulnerability","aliases":["CVE-2026-113584"],"related":[],"title":"WordPress placester plugin: unauthenticated users can change any account email","description":"The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.","summary":"The placester (Real Estate Website Builder) WordPress plugin through 1.4.3 has an AJAX action that updates account details with no capability, nonce or ownership check. An unauthenticated attacker can overwrite any user's email, including an administrator's, then take over the account via password reset. The plugin has been closed on WordPress.org since 2018, so no fix is expected.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"placester","fixed":[],"affected":"<= 1.4.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","placester","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check whether the placester plugin (Real Estate Website Builder) is installed: Plugins screen, or the wp-content/plugins/placester directory. Any version, including 1.4.3 (the last release), is affected per NVD. Also look for unexpected admin email changes and password-reset emails in your logs.","fix":"No fixed version exists. The plugin was permanently closed on WordPress.org on June 28, 2018 (author request) and 1.4.3 is the last release. Remove and uninstall the plugin.","status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:01+00:00","updated_at":"2026-11-06T06:44:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T06:42:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress placester plugin: unauthenticated users can change any account email","impact":"high","summary":"The placester WordPress plugin through 1.4.3 has an AJAX action that updates account details with no capability, nonce or ownership check. An unauthenticated attacker can overwrite any user's email address, including an administrator's, then use the standard password-reset flow to take over the account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","placester","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over any site account, including administrators, via password reset","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry alone gives no fix or vendor advisory.","how_to_check":"- Check whether the `placester` plugin is installed and its version is `1.4.3` or earlier, in the WordPress plugins screen or the `wp-content/plugins/placester` directory.\n- Review the plugin's AJAX handlers for account-update actions that lack capability or nonce checks.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the placester WordPress plugin version 1.4.3 or earlier are exposed, because its AJAX action accepts account changes without any authorization check. Sites that do not run this plugin can skip it. The sources do not give a fixed version or a vendor patch.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4214,"output_tokens":559,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry alone gives no fix or vendor advisory.","search":"'-113584':13A,16A '-2026':12A,15A '1.4.3':33B,89C '2018':78B 'account':9A,40B,66B,105C,125C 'action':37B,102C 'address':116C 'administr':60B,119C 'ajax':36B,101C 'allow':107C 'attack':51B,109C 'builder':29B 'capabl':44B,94C 'chang':7A 'check':48B,98C 'close':74B 'cve':11A,14A 'detail':41B,106C 'email':10A,57B,115C 'estat':27B 'expect':83B 'fix':81B 'flow':132C 'host':22B 'includ':58B,117C 'nonc':45B,95C 'overwrit':53B,111C 'ownership':47B,97C 'packag':18B 'password':68B,130C 'password-reset':129C 'perform':92C 'placest':2A,19B,25B,85C 'placester':17A 'plugin':3A,31B,71B,87C 'real':26B 'reset':69B,131C 'self':21B 'self-host':20B 'sinc':77B 'standard':128C 'take':63B,122C 'unauthent':4A,50B,108C 'updat':39B,104C 'user':5A,55B,113C 'via':67B 'websit':28B 'wordpress':1A,23B,30B,86C 'wordpress.org':76B","nicknames":[],"mitigations":[],"who_affected":"Sites running the placester (Real Estate Website Builder) WordPress plugin, version 1.4.3 or earlier, are exposed: an AJAX action accepts account changes with no authorization check, so an anonymous visitor can change any user's email, including an administrator's, and take the account via password reset. The plugin was closed on WordPress.org in 2018 and has no patch, so any site still running it should remove it. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["placester"],"ptokens":["placester"],"labels":["high","package","placester","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-113584':13A,16A '-2026':12A,15A 'account':9A 'chang':7A 'cve':11A,14A 'email':10A 'placest':2A 'placester':17A 'plugin':3A 'unauthent':4A 'user':5A 'wordpress':1A","search_b":"'1.4.3':33B '2018':78B 'account':40B,66B 'action':37B 'administr':60B 'ajax':36B 'attack':51B 'builder':29B 'capabl':44B 'check':48B 'close':74B 'detail':41B 'email':57B 'estat':27B 'expect':83B 'fix':81B 'host':22B 'includ':58B 'nonc':45B 'overwrit':53B 'ownership':47B 'packag':18B 'password':68B 'placest':19B,25B 'plugin':31B,71B 'real':26B 'reset':69B 'self':21B 'self-host':20B 'sinc':77B 'take':63B 'unauthent':50B 'updat':39B 'user':55B 'via':67B 'websit':28B 'wordpress':23B,30B 'wordpress.org':76B","search_c":"'1.4.3':89C 'account':105C,125C 'action':102C 'address':116C 'administr':119C 'ajax':101C 'allow':107C 'attack':109C 'capabl':94C 'check':98C 'detail':106C 'email':115C 'flow':132C 'includ':117C 'nonc':95C 'overwrit':111C 'ownership':97C 'password':130C 'password-reset':129C 'perform':92C 'placest':85C 'plugin':87C 'reset':131C 'standard':128C 'take':122C 'unauthent':108C 'updat':104C 'user':113C 'wordpress':86C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113584","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113584:1869","url":"https://wordpress.org/plugins/placester/","severity":null,"published_at":"2026-11-06T06:44:17+00:00","modified_at":"2026-11-06T06:44:17+00:00","first_seen_at":"2026-11-06T06:44:17+00:00","fetched_at":"2026-11-06T06:44:17+00:00","note":"NVD only; WordPress.org page says plugin permanently closed June 28, 2018, last version 1.4.3, so no patch. No vendor advisory found, no exploitation or PoC seen. Nothing verified.","cites":["https://wordpress.org/plugins/placester/","https://nvd.nist.gov/vuln/detail/CVE-2026-113584"]}],"documents":[{"id":84168,"url":"https://wordpress.org/plugins/placester/","title":"Real Estate Website Builder (placester) - WordPress.org plugin page: closed permanently June 28, 2018","kind":"vendor","source":"analyst","publisher":null,"text":"This plugin has been closed as of June 28, 2018 and is not available for download. This closure is permanent. Reason: Author Request. Version 1.4.3, last updated 10 years ago.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84169,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113584","title":"NVD CVE-2026-113584","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}