PT-2025-2107 · WordPress · Essential Real Estate

Thanh Nam Tran · Published 2025-01-10 · Updated 2025-02-25 · CVE-2024-13318

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Essential WP Real Estate plugin for WordPress versions up to, and including, 1.1.3

Description The issue is caused by a missing capability check on the cl delete listing func() function, allowing unauthorized access. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.

Recommendations For versions up to, and including, 1.1.3, update to a version that includes a fix for the missing capability check on the cl delete listing func() function. As a temporary workaround, consider disabling the cl delete listing func() function until a patch is available.

Fix

Weakness Enumeration

CWE-463

Related Identifiers

CVE-2024-13318

Affected Products

Essential Real Estate

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13318 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13318 · Vendor Advisory
• https://t.me/cvenotify/112424 · Telegram Post
• https://twitter.com/CVEnew/status/1877678188022714560 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve · Note
• https://t.me/cvedetector/14953 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877825125401133274 · Twitter Post
• https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724 · Note
• https://t.me/cvenotify/107015 · Telegram Post