by Kastro
Paper/Archive/CVE-2026-113584

CVE-2026-113584

Unknown placester — Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
31
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 8.3.083 × 201.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

Affected

ProductAffectedFixed inSource
placester≤ 1.4.3–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/f8261325-51d6-477e-af17-11b6de10c232