The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated… (CVE-2026-13159)

CVE-2026-13159 affects the Real Estate Papi WordPress theme through version 1.0.5. The theme does not enforce capability or CSRF protections on a particular AJAX action, enabling any authenticated user to trigger the installation of predefined companion plugins from the official WordPress repository. When the request executes in a session of a user who can activate plugins, those plugins are also activated automatically. This represents a privilege escalation vector via insufficient authorization and CSRF protections (CWE-862).

An attacker with any authenticated user account on a site using the vulnerable theme can cause the installation of companion plugins without proper authorization checks. If the attacker can perform the action in a session of a user with plugin activation rights, the plugins are activated automatically. This could lead to unauthorized plugin installations and potential further compromise depending on the installed plugins. There is no direct confidentiality or availability impact reported.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should restrict authenticated user roles carefully and monitor plugin installations. Applying principle of least privilege to user roles may reduce risk.