PT-2025-24607 · WordPress · Rh - Real Estate Wordpress Theme

Thái An · Published 2025-06-10 · Updated 2025-07-17 · CVE-2025-4601

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RH - Real Estate WordPress Theme versions prior to 4.4.1

Description The issue is related to privilege escalation due to the theme not properly restricting user roles that can be updated as part of the inspiry update profile() function. This allows authenticated attackers with subscriber-level access and above to set their role to that of an administrator.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 to fully patch the vulnerability. As a temporary workaround, consider restricting access to the inspiry update profile() function until the issue is resolved.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-4601

Affected Products

Rh - Real Estate Wordpress Theme

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-4601 · Security Note
• https://twitter.com/the_yellow_fall/status/1932259888178340229 · Twitter Post
• https://t.me/latest_high_impact_cve/2598 · Telegram Post
• https://t.me/latest_high_impact_cve/2599 · Telegram Post
• https://twitter.com/Komodosec/status/1945664806683574579 · Twitter Post
• https://themeforest.net/item/real-homes-wordpress-real-estate-theme/5373914 · Note
• https://t.me/cvenotify/125200 · Telegram Post
• https://t.me/cvetracker/25864 · Telegram Post
• https://t.me/pentestingnews/62863 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a816e5a8-2494-4bcf-869d-5214b21f7791?source=cve · Note