A newly tracked flaw, CVE-2026-104913, affects the Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress through version 2.6.0. Its ZIP-import feature skips capability and nonce checks along with file-type validation, so any authenticated user with subscriber-level access can upload arbitrary files to the server, opening the door to further compromise.
// source: nvd.nist.gov ↗