# CVE-2026-104913: Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

Status: published. Published: 2026-11-07. Updated: 2026-11-07.

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- esaia / Interactive Real Estate – Floor Plan & Building Visualizer: ≥ 0; ≤ 2.6.0 (affected, semver). Source: CNA: Wordfence

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: Wordfence

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-434

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5aeab8b-86f7-4453-9070-632dceaf137d?source=cve (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/interactive-real-estate/tags/2.5.5/includes/controllers/DataImportExport.php#L496 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/interactive-real-estate/tags/2.5.5/includes/controllers/DataImportExport.php#L888 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/interactive-real-estate/tags/2.5.5/includes/controllers/DataImportExport.php#L149 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/changeset?reponame=&old=3783603%40interactive-real-estate&new=3783603%40interactive-real-estate (CNA: Wordfence)

## Provenance

- CNA: Wordfence: https://www.cve.org/CVERecord?id=CVE-2026-104913; retrieved 2026-11-07; source updated 2026-11-07

Revision: 81da8db2931e1fb2688a0c0cf8446e8f1f90e9498134f82fbedf3c4cbc5ea7c1

Canonical: https://y2.dev/cve/CVE-2026-104913

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.