CVE-2025-6934

Description

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Reserved 2025-06-30 | Published 2025-07-01 | Updated 2025-07-02 | Assigner Wordfence

Problem types

CWE-269 Improper Privilege Management

Product status

Default status
unaffected

*
affected

Timeline

2025-06-30:

Disclosed

Credits

Alyudin Nafiie finder

References

www.wordfence.com/...-67b4-4347-91a6-dbf98da5ceaf?source=cve

themeforest.net/...state-responsive-wordpress-theme/16179481

plugins.trac.wordpress.org/...user/class-opalestate-user.php

plugins.trac.wordpress.org/...user/class-opalestate-user.php

cve.org (CVE-2025-6934)

nvd.nist.gov (CVE-2025-6934)

Download JSON