CVE-2026-104913 Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extractzipdata function. This is due to missing capability check, nonce verification, and file extension or MIME type...

CVE-2026-104913

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress (versions up to and including 2.6.0 ) is vulnerable to Arbitrary File Upload via the extract_zip_data function. The root cause is a lack of capability checks, nonce verification, and file extension or MIME type va...