CVE-2026-104913
Deferred Deferred - Pending Action

Arbitrary File Upload in Interactive Real Estate Floor Plan Visualizer

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-104913
EUVD
EUVD-2026-118566

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
esaia Interactive Real Estate – Floor Plan & Building Visualizer From 0 (inc) to 2.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Arbitrary File Upload flaw in the Interactive Real Estate – Floor Plan & Building Visualizer WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to upload malicious files to the server by exploiting missing capability checks, nonce verification, and improper file validation in the extract_zip_data function. The plugin must have an active Freemius Premium license or trial for exploitation to be possible.

Detection Guidance

Check for unauthorized files in the WordPress uploads directory, especially executable files. Review plugin logs for suspicious ZIP extraction activity. Use commands like 'find /path/to/uploads -type f -name "*.php"' to locate unexpected PHP files.

Impact Analysis

This vulnerability can lead to remote code execution on your WordPress site. Attackers could upload executable files, take control of your website, steal data, or use it to launch further attacks. The impact depends on the attacker's goals and the site's configuration.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR, HIPAA, or other regulations. If exploited, attackers could access sensitive data, leading to legal penalties, fines, or reputational damage for non-compliance with data protection requirements.

Mitigation Strategies

Immediately update the Interactive Real Estate plugin to the latest version beyond 2.6.0. If an update is unavailable, disable and remove the plugin. Restrict file upload permissions and monitor for unauthorized file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...