CVE-2026-104913

Name of the Vulnerable Software and Affected Versions Interactive Real Estate – Floor Plan & Building Visualizer versions prior to 2.6.1

Description An arbitrary file upload issue exists in the extract zip data() function. The flaw stems from a lack of capability checks, nonce verification, and validation of file extensions or MIME types when copying ZIP members to the uploads directory. Authenticated users with subscriber-level access or higher can exploit this to upload executable files, potentially leading to remote code execution. This issue is only present on sites with an active Freemius Premium license or trial, as the system relies on a site-level license check instead of per-user capability verification.

Recommendations Update Interactive Real Estate – Floor Plan & Building Visualizer to version 2.6.1 or later. As a temporary mitigation, restrict access to the extract zip data() function for users with low-level privileges.