The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an …

The Streamit WordPress theme through version 4.5.0 contains a critical security flaw in one of its unauthenticated AJAX routes. The route fails to perform any authorization or nonce verification, allowing unauthenticated attackers to invoke arbitrary PHP functions with attacker-supplied arguments. This can be exploited to create administrator accounts, leading to full privilege escalation. The vulnerability also enables remote code execution on affected WordPress installations. No authentication is required to exploit this vulnerability, making it particularly dangerous. The issue is tracked as CVE-2026-13423 and has been documented by both NVD and WPScan.