PT-2025-27507 · WordPress · Opal Estate Pro
Alyudin Nafiie
·
Publicado
2025-07-01
·
Atualizado
2026-01-24
·
CVE-2025-6934
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Opal Estate Pro – Property Management and Submission plugin for WordPress versions up to, and including, 1.7.5
Description:
The issue is due to a lack of role restriction during registration in the
on regiser user function, making it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.Recommendations:
For Opal Estate Pro – Property Management and Submission plugin for WordPress versions up to, and including, 1.7.5, consider disabling the
on regiser user function until a patch is available to prevent privilege escalation. Restrict access to the registration process to minimize the risk of exploitation. Avoid using the registration feature in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.LPE
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opal Estate Pro