PT-2025-33709 · WordPress · Wordpress+1

Alyudin Nafiie

·

Publicado

2025-08-19

·

Atualizado

2025-10-22

·

CVE-2025-6758

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Real Spaces - WordPress Properties Directory Theme versions prior to 3.7
Description: The Real Spaces - WordPress Properties Directory Theme for WordPress is susceptible to privilege escalation through the imic agent register function. This issue stems from a lack of restrictions on the registration role, allowing unauthenticated attackers to arbitrarily select their role, including Administrator, during user registration.
Recommendations: Real Spaces - WordPress Properties Directory Theme versions prior to 3.7: Upgrade to version 3.7 or later to address the unrestricted registration role issue and prevent privilege escalation. As a temporary workaround, consider restricting access to the imic agent register function until a patch is available.

Correção

LPE

Improper Privilege Management

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-6758

Produtos afetados

Real Spaces
Wordpress