{"id":"CVE-2026-126119","kind":"vulnerability","aliases":["CVE-2026-126119"],"related":[],"title":"Streamit WordPress plugin lets anyone run arbitrary PHP functions","description":"The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.","summary":"The Streamit WordPress plugin before 1.3.10 has an unauthenticated AJAX route that calls an attacker-chosen PHP function with attacker-chosen arguments. An attacker can use this to create an administrator account and reach remote code execution.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Streamit","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","streamit","wordpress"],"not_affected_if":["plugin-not-installed","version-1.3.10-or-later"],"how_to_check":"- Check whether the Streamit plugin is installed and its version is below `1.3.10` in the WordPress admin plugin list or `wp-content/plugins/streamit/`","fix":"- Update the Streamit plugin to `1.3.10` or later","status":"open","published_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","triaged_at":"2026-11-13T06:42:22+00:00","updated_at":"2026-11-13T06:42:22+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T06:42:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Streamit plugin to `1.3.10` or later\n- unknown for other fixes","reach":"internet","title":"Streamit WordPress plugin lets anyone run arbitrary PHP functions","impact":"high","summary":"The Streamit WordPress plugin before 1.3.10 has an unauthenticated AJAX route that calls an attacker-chosen PHP function with attacker-chosen arguments. An attacker can use this to create an administrator account and reach remote code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","streamit","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker creates admin account and runs code on the server","analyst_note":"Confirm the plugin's vendor page and the NVD entry for the fixed version and whether any setting is needed to expose the route.","how_to_check":"- Check whether the Streamit plugin is installed and its version is below `1.3.10` in the WordPress admin plugin list or `wp-content/plugins/streamit/`\n- unknown for other checks","plain_action":"","product_name":"Streamit","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.3.10-or-later"],"who_is_affected":"Sites running the Streamit WordPress plugin before version 1.3.10 are exposed, because the vulnerable AJAX route needs no login. Sites without this plugin are not affected. The sources do not say whether any non-default configuration is required.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000751,"input_tokens":4575,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126119':12A,15A '-2026':11A,14A '1.3.10':28B,67C 'account':56B,111C 'administr':55B,110C 'ajax':32B,81C 'allow':98C 'anyon':5A 'arbitrari':7A,103C 'argument':46B,96C 'array':97C 'attack':38B,44B,48B,87C,94C,100C 'attacker-chosen':37B,43B 'attacker-suppli':86C,93C 'author':72C 'call':35B,102C 'chosen':39B,45B 'code':60B,118C 'creat':53B,108C 'cve':10A,13A 'escal':115C 'exampl':106C 'execut':61B,119C 'function':9A,41B,90C,104C 'host':20B 'invok':84C 'lead':112C 'let':4A 'nonc':74C 'one':77C 'perform':70C 'php':8A,40B,89C 'plugin':3A,26B,65C 'privileg':114C 'reach':58B 'remot':59B,117C 'rout':33B,82C 'run':6A 'self':19B 'self-host':18B 'streamit':1A,16A,21B,24B,63C 'suppli':88C,95C 'unauthent':31B,80C,99C 'use':50B 'verif':75C 'wordpress':2A,22B,25B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Streamit WordPress plugin before version 1.3.10 are exposed, because the vulnerable AJAX route needs no login. Sites without this plugin are not affected. The sources do not say whether any non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["streamit"],"ptokens":["streamit"],"labels":["critical","other","selfhosted","streamit","vendor","wordpress"],"campaign_type":null,"search_a":"'-126119':12A,15A '-2026':11A,14A 'anyon':5A 'arbitrari':7A 'cve':10A,13A 'function':9A 'let':4A 'php':8A 'plugin':3A 'run':6A 'streamit':1A,16A 'wordpress':2A","search_b":"'1.3.10':28B 'account':56B 'administr':55B 'ajax':32B 'argument':46B 'attack':38B,44B,48B 'attacker-chosen':37B,43B 'call':35B 'chosen':39B,45B 'code':60B 'creat':53B 'execut':61B 'function':41B 'host':20B 'php':40B 'plugin':26B 'reach':58B 'remot':59B 'rout':33B 'self':19B 'self-host':18B 'streamit':21B,24B 'unauthent':31B 'use':50B 'wordpress':22B,25B","search_c":"'1.3.10':67C 'account':111C 'administr':110C 'ajax':81C 'allow':98C 'arbitrari':103C 'argument':96C 'array':97C 'attack':87C,94C,100C 'attacker-suppli':86C,93C 'author':72C 'call':102C 'code':118C 'creat':108C 'escal':115C 'exampl':106C 'execut':119C 'function':90C,104C 'invok':84C 'lead':112C 'nonc':74C 'one':77C 'perform':70C 'php':89C 'plugin':65C 'privileg':114C 'remot':117C 'rout':82C 'streamit':63C 'suppli':88C,95C 'unauthent':80C,99C 'verif':75C 'wordpress':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126119","severity":null,"published_at":"2026-11-13T06:16:54+00:00","modified_at":"2026-11-13T06:16:54+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","fetched_at":"2026-11-13T06:42:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}