PT-2025-6435 · WordPress · The Real Estate 7

Lucio Sá · Published 2025-02-12 · Updated 2025-02-25 · CVE-2024-13421

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Real Estate 7 WordPress theme for WordPress versions up to, and including, 3.5.1

Description The issue is due to the plugin not properly restricting the roles allowed to be selected during registration, making it possible for unauthenticated attackers to register a new administrative user account. This allows for privilege escalation.

Recommendations For versions up to, and including, 3.5.1, update to a version that properly restricts user roles during registration to prevent unauthenticated attackers from registering administrative accounts. As a temporary workaround, consider restricting access to the user registration process until a patch is available.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-13421

Affected Products

The Real Estate 7

References · 10

• https://osv.dev/vulnerability/CVE-2024-13421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13421 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve · Note
• https://contempothemes.com/changelog · Note
• https://t.me/cvenotify/110996 · Telegram Post
• https://t.me/cvenotify/112386 · Telegram Post
• https://t.me/cvedetector/17821 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1889650040492130531 · Twitter Post
• https://twitter.com/CVEnew/status/1889673516653375908 · Twitter Post
• https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778 · Note