PT-2025-19824 · WordPress · Reales Wp Stpt

Friderika Baranyai · Published 2025-05-06 · Updated 2025-05-07 · CVE-2025-3610

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Reales WP STPT plugin for WordPress versions up to and including 2.1.2

Description The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as the password. This allows authenticated attackers with subscriber-level access or higher to change arbitrary users' passwords and email addresses, including those of administrators, thereby gaining access to their accounts.

Recommendations For versions up to and including 2.1.2, update to a version higher than 2.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's user update functionality to prevent attackers from exploiting this issue.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3610

Affected Products

Reales Wp Stpt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3610 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/38c6b149-39d7-491a-9f3a-261087a52a03?source=cve · Note
• https://t.me/cvedetector/24535 · Telegram Post
• https://twitter.com/cybercronai/status/1920007028967096356 · Twitter Post
• https://t.me/latest_high_impact_cve/2278 · Telegram Post
• https://twitter.com/CVEnew/status/1919585221688562077 · Twitter Post
• https://t.me/cvenotify/120921 · Telegram Post
• https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568 · Note