CVE-2025-2237 | THREATINT

Description

The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to authentication bypass in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.

Reserved 2025-03-11 | Published 2025-04-01 | Updated 2025-04-01 | Assigner Wordfence

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-269 Improper Privilege Management

Product status

Default status

unaffected

affected

Timeline

2025-03-31:

Disclosed

Credits

Tonn finder

References

www.wordfence.com/...-3bc3-4572-97fd-a039d54ac0ff?source=cve

themeforest.net/...omeo-real-estate-wordpress-theme/26372986

cve.org (CVE-2025-2237)

nvd.nist.gov (CVE-2025-2237)

Download JSON