Executive brief
The Streamit WordPress theme, used for video streaming and entertainment websites, contains a critical security flaw that allows unauthorized individuals to take full control of the site. By exploiting a poorly secured communication channel (AJAX route), an attacker can execute their own commands on the server without needing a password. This can lead to the creation of unauthorized administrator accounts, theft of customer data, or a complete shutdown of the website.
Technical details
The Streamit WordPress theme (up to version 4.5.0) suffers from an arbitrary function call vulnerability within one of its unauthenticated AJAX routes. The affected component fails to implement any authorization checks or CSRF protection (nonces) before processing requests. An attacker can supply a PHP function name and an associated array of arguments to be executed by the server. This allows for unauthenticated privilege escalation (e.g., creating a new admin user) and full remote code execution (RCE). As of the advisory date, no fix has been reported.
Affected products
- Streamit Streamit <= 4.5.0
Timeline
- 2026-07-08: disclosed: Publicly published by WPScan
- 2026-07-29: advisory: CVE published to NVD dataset