External risk intelligence

Placester WordPress Plugin Account Takeover via Email Reset

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-113584

The vulnerability exists in a WordPress plugin. WordPress installations are commonly deployed as public-facing web applications, and AJAX endpoints in such plugins are typically accessible to internet users by default, making this surface commonly exposed.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Placester WordPress plugin. This issue allows unauthenticated attackers to potentially overwrite user email addresses and gain unauthorized account access. The main concern at this time is confirming whether this specific plugin is in use and, if so, to what extent.

Unauthenticated attackers can change user emails.
Account takeover is possible via password reset.
Confirm plugin usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target any user, including administrators, by exploiting a flaw in how the Placester WordPress plugin handles account updates. This vulnerability allows unauthenticated individuals to change a user's email address. Once the email is changed, the attacker can initiate a password reset to gain full control of the account.

No authentication required to access.
Unprotected AJAX action updates account details.
Account takeover via password reset.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could overwrite any user's email address, including an administrator's, by exploiting an unprotected AJAX action in the placester WordPress plugin. This could enable account takeover via the standard password-reset process when the plugin is used.

User email addresses and account control.
Unprotected AJAX action allows overwrites.
Account takeover via password reset.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability in the Placester WordPress plugin impacts account security through unauthenticated access to modify user email addresses, enabling account takeover. Typically, the application owner, in collaboration with the platform or infrastructure team, is responsible for addressing such plugin-level vulnerabilities. The first practical step is to confirm the presence of the Placester plugin on any WordPress sites, assess its reachability, and identify the accountable owner to plan remediation based on the identified risk.

Application owners should manage the issue.
Verify plugin presence and network exposure first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Placester WordPress plugin?

Placester is a plugin used within WordPress environments, specifically designed to help real estate professionals manage property listings and create websites. It integrates directly into the WordPress dashboard, allowing users to handle their real estate content and site settings. Because it runs as a standard plugin, it extends the core functionality of a WordPress site to support property-focused web features.

What does CVE-2026-113584 mean in plain English?

This vulnerability is classified as Improper Privilege Management (CWE-269). It means the plugin fails to check if a person is authorized to perform certain actions. Specifically, it lacks security checks on a background technical function used for account updates. Because these checks are missing, the system mistakenly allows anyone—even someone not logged in—to change another person's email address in the database, leading to potential account hijacking.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted request to the plugin's unprotected AJAX endpoint. This action does not require the attacker to have an existing account, be logged in, or hold any special permissions. It is important to note that this bug is not triggered by normal site browsing or by standard users performing routine tasks; it requires active, unauthorized interaction with the specific background function that updates account details.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is particularly relevant for WordPress installations that are public-facing. Because AJAX endpoints for such plugins are generally accessible to anyone on the internet by default, this creates a significant path for potential exploitation. If your WordPress site is reachable from the public web and has the Placester plugin enabled, it is considered to have an exposed surface that requires your attention.

What should I do if I use this plugin?

Your first step is to verify whether the Placester plugin is currently installed and active on any of your WordPress sites. Once you have confirmed its presence, coordinate with your technical team to assess the site's exposure to the internet. Because this issue allows for total account takeover, prioritize identifying the application owner to discuss immediate remediation steps, such as disabling the plugin or removing it until a secure update is applied.

References

wpscan.com/vulnerability/f8261325-51d6-477e-af17-11b6de10c232/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.