CVE-2026-13423 is a critical code injection vulnerability (CWE-94) in the Streamit WordPress theme through version 4.5.0. The theme exposes an unauthenticated AJAX endpoint that does not perform authorization or nonce checks, allowing attackers to supply arbitrary PHP function names and arguments. This can lead to attackers executing arbitrary code, including creating administrator accounts, resulting in full system compromise. The vulnerability has a CVSS 3.1 score of 9.8, reflecting its high impact and ease of exploitation.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP functions remotely, leading to privilege escalation and remote code execution. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing full administrative control over the WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict access to the vulnerable AJAX route if possible, and monitor for updates from the theme vendor. Avoid using versions up to 4.5.0 in production environments.