---
id: "CVE-2026-113584"
page: "https://infrastack.ai/live/CVE-2026-113584"
kind: "vulnerability"
aliases: ["CVE-2026-113584"]
title: "WordPress placester plugin: unauthenticated users can change any account email"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "placester", "fixed": [], "affected": "<= 1.4.3", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "placester", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T06:16:39+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:44:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113584", "first_seen_at": "2026-11-06T06:40:11+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/placester/", "first_seen_at": "2026-11-06T06:44:17+00:00", "cites": ["https://wordpress.org/plugins/placester/", "https://nvd.nist.gov/vuln/detail/CVE-2026-113584"]}]
exploit_sources: []
---

# WordPress placester plugin: unauthenticated users can change any account email

Link for people: https://infrastack.ai/live/CVE-2026-113584 (this .md is for agents)

The placester (Real Estate Website Builder) WordPress plugin through 1.4.3 has an AJAX action that updates account details with no capability, nonce or ownership check. An unauthenticated attacker can overwrite any user's email, including an administrator's, then take over the account via password reset. The plugin has been closed on WordPress.org since 2018, so no fix is expected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:placester affected <= 1.4.3 fixed no fixed version listed

## How to check

Check whether the placester plugin (Real Estate Website Builder) is installed: Plugins screen, or the wp-content/plugins/placester directory. Any version, including 1.4.3 (the last release), is affected per NVD. Also look for unexpected admin email changes and password-reset emails in your logs.

## Fix

No fixed version exists. The plugin was permanently closed on WordPress.org on June 28, 2018 (author request) and 1.4.3 is the last release. Remove and uninstall the plugin.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113584
- 2026-11-06T06:44:17+00:00 analyst https://wordpress.org/plugins/placester/ — NVD only; WordPress.org page says plugin permanently closed June 28, 2018, last version 1.4.3, so no patch. No vendor advisory found, no exploitation or PoC seen. Nothing verified.

## Documents

- [advisory] Real Estate Website Builder (placester) - WordPress.org plugin page: closed permanently June 28, 2018 https://wordpress.org/plugins/placester/
- [describes] NVD CVE-2026-113584 https://nvd.nist.gov/vuln/detail/CVE-2026-113584

## From the sources

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_