The Interactive Real Estate – Floor Plan & Building Visualizer WordPress plugin up to version 2.6.0 contains an arbitrary file upload vulnerability via the extract_zip_data function. Authenticated users with subscriber-level access or higher can upload malicious files due to missing capability checks, nonce verification, and file type validation. Exploitation requires the plugin's Freemius Premium license or trial to be active, enabling remote code execution.