Vulnerability details

CVE-2026-113584

placester

Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

CVSS 3.1

9.8Critical

Official description

The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	placester	v ≤ 1.4.3	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/f8261325-51d6-477e-af17-11b6de10c232/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-06
Last updated: 2026-11-06
State: Published
Assigner (CNA): WPScan
Kolun priority: 34 · Low

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

37.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-269
Improper Privilege Management