We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-6934

Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'



Description

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Reserved 2025-06-30 | Published 2025-07-01 | Updated 2025-07-01 | Assigner Wordfence


CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-269 Improper Privilege Management

Product status

Default status
unaffected

*
affected

Timeline

2025-06-30:Disclosed

Credits

Alyudin Nafiie finder

References

www.wordfence.com/...-67b4-4347-91a6-dbf98da5ceaf?source=cve

themeforest.net/...state-responsive-wordpress-theme/16179481

plugins.trac.wordpress.org/...user/class-opalestate-user.php

plugins.trac.wordpress.org/...user/class-opalestate-user.php

cve.org (CVE-2025-6934)

nvd.nist.gov (CVE-2025-6934)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-6934

Support options

Helpdesk Chat, Email, Knowledgebase