Description

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-07T03:16:59.167Z",
  "pubdate": "2026-11-07T03:16:59.167Z",
  "executiveSummary": "The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability, categorized as a critical security flaw. This vulnerability persists in all versions up to and including 2.6.0. The issue stems from the plugin's failure to implement proper authorization, nonce validation, and file sanitization within the extract_zip_data function.\nThe flaw allows authenticated users with subscriber-level privileges or higher to upload arbitrary files, including executable scripts, directly to the server's filesystem. This vulnerability is specifically exploitable when a Freemius Premium license or trial is active, as the logic relies on a site-level license check instead of robust capability-based access control. Successful exploitation leads to Remote Code Execution (RCE), enabling an attacker to compromise the WordPress installation, execute arbitrary system commands, and potentially gain full control over the underlying server environment. The lack of validation regarding file extensions or MIME types permits attackers to bypass basic security filters, making this a high-risk vector for malicious activity.",
  "technicalDetails": "The root cause of this vulnerability lies within the extract_zip_data function, which processes ZIP archive uploads without verifying the integrity or origin of the request. The plugin fails to utilize WordPress nonces for request validation and neglects to perform capability checks to ensure the user is authorized to perform file operations. Consequently, the handler lacks the necessary security boundary to restrict access based on user roles, relying solely on a site-wide Freemius license check.\nThe attack flow begins with an authenticated attacker, possessing at least subscriber-level permissions, targeting the plugin's file upload interface. Because the extract_zip_data function does not implement whitelist-based file extension filtering or perform MIME type verification on the contents of the uploaded ZIP archive, an attacker can craft a malicious ZIP file containing executable scripts (e.g., .php or other server-side scripting languages).\nUpon uploading the crafted ZIP, the function automatically extracts its members directly into the WordPress uploads directory. The absence of path sanitization or validation logic allows the attacker to place executable files in a web-accessible directory. Once the file is extracted, the attacker can trigger the malicious code simply by navigating to the file's URL path through a standard web browser request.\nExploitation requires the victim's site to have a Freemius Premium license or trial enabled, as this environment condition satisfies the only conditional gate present in the code before the file processing logic is executed. Because the plugin does not enforce per-user capabilities, any user with standard authentication can satisfy the condition required to reach the vulnerable code path. The post-exploitation impact is severe, as the ability to execute arbitrary PHP code on the server grants the attacker the capacity to modify the database, exfiltrate sensitive site data, install web shells for persistence, or pivot into the broader network infrastructure. This vulnerability represents a fundamental breakdown in secure file handling practices, specifically regarding input validation and the principle of least privilege."
}