THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-13159 (MEDIUM 4.3) — The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the s

[NVD] CVE-2026-13159 (MEDIUM 4.3) — The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the s

highnvdPublished 2026-09-06

CVE-2026-13159 CVSS: 4.3 MEDIUM Published: 2026-09-06T07:16:41.900

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activ

Indicators of compromise

CVE-2026-13159cve
wordpress.orgdomain

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-13159