CVE-2026-13423: Streamit WordPress Theme RCE Vulnerability

CVE-2026-13423 Overview

The Streamit WordPress theme through version 4.5.0 contains an unauthenticated remote code execution vulnerability. The theme exposes an AJAX route that performs no authorization checks and no nonce verification. This route invokes an attacker-supplied PHP function with an attacker-supplied argument array. Unauthenticated attackers can call arbitrary PHP functions, including those that create administrator accounts or execute system commands. The flaw enables full privilege escalation and remote code execution on affected WordPress installations. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code.

Critical Impact

Unauthenticated attackers can invoke arbitrary PHP functions on the target site, leading to administrator account creation, full site takeover, and remote code execution.

Affected Products

• Streamit WordPress theme versions up to and including 4.5.0
• WordPress installations using the vulnerable theme
• Any hosting environment running the affected theme code

Discovery Timeline

• 2026-07-29 - CVE-2026-13423 published to NVD
• 2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13423

Vulnerability Analysis

The Streamit theme registers an AJAX endpoint accessible to unauthenticated users through the wp_ajax_nopriv_ hook. The handler reads a function name and argument array directly from the HTTP request. It then passes these values to a dynamic PHP function invocation without validating either input. No capability check, nonce verification, or allowlist restricts which functions may be called.

Attackers exploit this by sending a crafted POST request to admin-ajax.php. The request specifies the target PHP function and an array of arguments. The handler executes the function with attacker-controlled data. Calling wp_insert_user with administrator role parameters creates a privileged account. Calling functions such as shell_exec or system executes operating system commands.

Root Cause

The root cause is the combination of three implementation errors. The AJAX route uses the nopriv handler variant, exposing it to unauthenticated users. The handler omits check_ajax_referer or equivalent nonce verification. The handler treats the function name parameter as trusted input and invokes it dynamically. This pattern matches [CWE-94] Improper Control of Generation of Code.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends an HTTP POST request to the admin-ajax.php endpoint with the vulnerable action parameter. The request body includes the target function name and its arguments. No authentication, user interaction, or prior reconnaissance beyond identifying the theme is required. Refer to the WPScan Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-13423

Indicators of Compromise

• Unexpected administrator accounts created in the WordPress wp_users table
• POST requests to /wp-admin/admin-ajax.php from unauthenticated sources targeting Streamit-specific actions
• Web server logs showing repeated AJAX calls with function name parameters such as wp_insert_user, shell_exec, or eval
• New or modified PHP files in the theme, plugin, or uploads directories
• Outbound network connections from the web server to unknown hosts following AJAX traffic

Detection Strategies

• Inspect admin-ajax.php access logs for POST bodies containing function name fields and argument arrays
• Monitor the WordPress database for newly created users with administrator role assigned outside change windows
• Deploy web application firewall rules that block requests containing dangerous PHP function names in POST parameters
• Correlate web request telemetry with file integrity monitoring events on the WordPress installation

Monitoring Recommendations

• Enable verbose access logging on all endpoints under /wp-admin/ and forward logs to a centralized platform
• Alert on creation of new administrator accounts and privilege changes in WordPress
• Track file writes and executions within the wp-content/themes/streamit/ directory
• Monitor outbound connections from PHP worker processes for anomalous destinations

How to Mitigate CVE-2026-13423

Immediate Actions Required

• Deactivate and remove the Streamit theme until a patched version is confirmed available
• Audit the WordPress user table and remove any unauthorized administrator accounts
• Rotate all administrator credentials and API keys stored in the WordPress instance
• Review theme, plugin, and upload directories for unauthorized PHP files or backdoors

Patch Information

No vendor patch was referenced in the NVD entry at the time of publication. Site operators should consult the WPScan Vulnerability Report for the latest fix status and monitor the theme vendor for a release above version 4.5.0.

Workarounds

• Block requests to admin-ajax.php that target the vulnerable Streamit action at the WAF or reverse proxy layer
• Restrict access to /wp-admin/admin-ajax.php by source IP where feasible
• Replace the Streamit theme with an alternative supported theme until a fix is published
• Disable PHP execution in wp-content/uploads/ to limit post-exploitation file drops

# Example WAF rule (ModSecurity) blocking dangerous function invocation via admin-ajax
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026134230,\
   msg:'Block Streamit CVE-2026-13423 exploitation attempt'"
  SecRule ARGS "@rx (?i)(wp_insert_user|shell_exec|system|passthru|exec|eval|assert)" "t:none"