Vulnerability · Published Sep 6, 2026 · Assigned by WPScan
CVE-2026-13159Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
Medium 4.3
In plain English
A medium-severity missing authorization in Real Estate Papi from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Real Estate Papi | 0 – through 1.0.5 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/3eea9204-d9ea-474e-a299-31d1aa0385e0/ exploit, vdb-entry, technical-description