Streamit exposes unauthenticated arbitrary PHP function calls
Streamit theme through 4.5.0 exposes an unauthenticated AJAX route without authorization or nonce verification. The route accepts both an attacker-selected PHP function and an attacker-controlled argument array, then invokes that callable. This permits an anonymous attacker to call available PHP or WordPress functions, including a function sequence that creates an Administrator account, and can lead to full site takeover and remote code execution. WPScan has withheld the proof of concept until remediation, so the exact AJAX action, request parameter names, handler function, and callable invocation mechanism are not currently disclosed. WPScan reports no known fixed release.
- Component
- Streamit
- Plugin slug
streamit- Affected
- <= 4.5.0
- Safe version
- See mitigation notes
- Published
- Jul 29, 2026
- Weakness
- Not assigned
This CVE was published Jul 29, 2026 and is one of 3 known issues for this theme.
Update, patch or deactivate.
No fixed public release is currently available. Deactivate Streamit or apply a vendor-supplied patch that removes the arbitrary callable path and requires both authorization and nonce verification before re-enabling the theme. Review administrator accounts, theme and plugin files, scheduled tasks, and other persistence locations for unauthorized changes.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.