https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 21:35:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-104913 <p>The Interactive Real Estate – Floor Plan &amp; Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin&#39;s Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.</p> <p>The Interactive Real Estate – Floor Plan &amp; Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin&#39;s Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.</p> https://db.gcve.eu/vuln/fkie_cve-2026-104913 https://db.gcve.eu/vuln/ghsa-v8wh-4xxv-rwqj <p>The Interactive Real Estate – Floor Plan &amp; Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin&#39;s Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.</p> <p>The Interactive Real Estate – Floor Plan &amp; Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin&#39;s Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.</p> https://db.gcve.eu/vuln/ghsa-v8wh-4xxv-rwqj