Executive brief
The Real Estate Papi WordPress theme contains a vulnerability in its AJAX action handler that allows any authenticated user, including low-privilege subscribers, to install and activate companion plugins without authorization checks. An attacker with subscriber access could exploit this to inject malicious plugins into a website, potentially leading to full site compromise if the attacker can also activate those plugins.
Technical details
The vulnerability is a broken access control / missing authorization issue (CWE-862) in the theme's AJAX handler for the "install_act_plugin" action. The action lacks both capability checks (to verify the user has permission to install/activate plugins) and CSRF tokens, allowing any authenticated user to trigger plugin installation. An attacker with subscriber credentials (or via CSRF if a privileged user is tricked into visiting an external page) can call the AJAX endpoint to install a fixed set of companion plugins from WordPress.org. If the CSRF attack succeeds in the context of a session belonging to an admin/user with activation privileges, the installed plugins are also activated, granting the attacker code execution. No patch has been released as of the advisory date.
Affected products
- Real Estate Papi Real Estate Papi WordPress theme through 1.0.5
Timeline
- 2026-09-03: disclosed: Publicly published
- 2026-08-27: advisory: Added to WPVDB