{"affected":[{"defaultStatus":"unaffected","product":"Streamit","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.3.10","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-126119","cwes":["CWE-94"],"description":"The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/41d42891-1170-4e84-959c-d2eec010bf7c/"}],"kev":null,"metrics":[],"modifiedAt":1794549609870,"publishedAt":1794549609870,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/41d42891-1170-4e84-959c-d2eec010bf7c/"}],"remediation":[],"revision":"9f51cb0d3c263bcfed3f18b139bd1a7eda21385206a726993a15cd486ddf584e","sources":[{"modifiedAt":1794549609870,"name":"CNA: WPScan","retrievedAt":1794550163912,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126119"}],"ssvc":null,"status":"published","title":"Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call","updatedAt":1794550163912}