The Streamit WordPress theme before version 4.5.2 contains an unauthenticated flaw that sits on an unsecured AJAX endpoint. The endpoint fails to perform any authorization or nonce verification and directly invokes any PHP function supplied by the attacker, passing along an attacker‑supplied argument array. As a result, unauthenticated attackers can invoke arbitrary functions—such as those that create new administrator accounts or run arbitrary code—thereby achieving privilege escalation and remote code execution.

All installations of the Streamit theme before version 4.5.2 are affected, including the product belonging to the vendor Streamit.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1 % signals a low current exploitation probability. The flaw is not yet listed in the CISA KEV catalog. Attackers could exploit it by sending an unauthenticated HTTP POST request to the vulnerable AJAX route, which does not perform any authorization or nonce checks, and specifying the desired PHP function and arguments.