CVE-2026-13159: CWE-862 Missing Authorization in Real Estate Papi

CVE-2026-13159 is a missing authorization vulnerability (CWE-862) combined with a lack of CSRF protection (CWE-352) in the Real Estate Papi WordPress theme through version 1.0.5. The theme fails to verify user capabilities or perform CSRF checks on a specific AJAX action, enabling any authenticated user to trigger the installation of predefined companion plugins from the WordPress.org repository. When the request is executed in a session of a user who can activate plugins, those plugins are activated automatically, potentially leading to unauthorized changes in the WordPress environment.

An attacker with any authenticated user account, including low-privileged roles such as subscribers, can cause the installation of companion plugins without proper authorization. If the attacker can perform the action in a session where a user with plugin activation rights is active, those plugins will be activated automatically. This could lead to unauthorized plugin installations and activations, potentially enabling further exploitation or privilege escalation. The confidentiality and availability impacts are not directly affected, but integrity is impacted due to unauthorized plugin installation and activation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict authenticated user roles to trusted users only and monitor for unusual plugin installation activity. Consider disabling or restricting AJAX actions related to plugin installation if feasible.