Streamit: unauthenticated remote code execution (CVE-2026-13423)
A vulnerability, CVE-2026-13423 (CVSS 9.8), was published for the Streamit WordPress theme. One of its AJAX routes performs no authorization or nonce check and calls a PHP function with arguments supplied by the attacker.
Checked in Shield: no
Who is affected
Sites running the Streamit theme before version 4.5.2 are affected. An unauthenticated attacker can, for example, create an administrator account and achieve remote code execution (RCE).
How to check
In the WordPress admin, go to Appearance → Themes and check the Streamit version. If it is lower than 4.5.2, the site is vulnerable.
How to fix
A fix is available: update the Streamit theme to version 4.5.2 or later. After updating, review the list of administrators for accounts you do not recognize.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD.
