Description

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-06T07:16:41.900Z",
  "pubdate": "2026-09-06T07:16:41.900Z",
  "executiveSummary": "The Real Estate Papi WordPress theme, in versions up to 1.0.5, contains a critical vulnerability regarding improper access control within its AJAX interface. The theme fails to implement robust capability checks or cross-site request forgery (CSRF) protections for specific AJAX actions.\nThis vulnerability allows any authenticated user, including those with minimal privileges such as 'subscriber', to trigger the installation of pre-defined companion plugins hosted on the WordPress.org repository.\nIf the vulnerable AJAX request is executed within the active session of a user possessing administrative or plugin-activation privileges, the requested plugins are not only installed but automatically activated on the WordPress instance.\nThis flaw presents a significant security risk, as it permits unauthorized users to force the installation of arbitrary companion code, potentially leading to privilege escalation, persistent backdoors, or the injection of malicious functionality into the site environment. Exploitation requires minimal interaction from an attacker and relies on the lack of authorization validation during the theme's execution of AJAX requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of an AJAX action within the Real Estate Papi theme (versions 1.0.5 and below). The theme exposes an internal function designed to handle companion plugin installations without verifying the current user's security capabilities using WordPress functions such as current_user_can().\nFurthermore, the absence of anti-CSRF tokens (nonces) in these requests allows an attacker to perform unauthorized actions by tricking a higher-privileged user into executing the request, or by directly sending requests if the endpoint is not properly restricted by access control lists (ACLs).\nThe attack flow proceeds as follows: An attacker identifies the specific AJAX action hook utilized by the theme for plugin management. The attacker crafts a request targeting the admin-ajax.php endpoint. Since the backend handler fails to validate the user's role, the server-side code proceeds to interact with the WordPress Plugin API to fetch and install the defined companion plugins. If the request is triggered or proxied through a session belonging to a user with the 'activate_plugins' capability, the system automatically proceeds to the activation state.\nThe impact of this vulnerability is severe. By forcing the installation and activation of plugins, an attacker can effectively introduce new code execution paths into the WordPress installation. While limited to a 'fixed set' of companion plugins as defined by the theme, this can still be leveraged to deploy malicious payloads if any of the companion plugins contain their own vulnerabilities, or to alter the site configuration significantly. The lack of strict authorization allows a subscriber to bypass the standard administrative barrier normally required for plugin management. The vulnerability persists across all WordPress installations utilizing the Real Estate Papi theme versions 1.0.5 or lower, as the server-side logic consistently fails to enforce security context validation before initiating the file system and database changes associated with plugin installation and activation."
}