This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-13159 | BDVDB-2026-368585 Detail

Real Estate Papi

Description#

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-862 Missing Authorization
  • CWE-352 Cross-Site Request Forgery (CSRF)

References#

Exploit#

History#

  1. Version 1Record published in the CVE List.