What is the CVSS score of CVE-2025-4601?

CVE-2025-4601 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-4601?

The RH - Real Estate WordPress Theme contains a critical privilege escalation vulnerability allowing any authenticated user to gain administrator access to affected WordPress sites.

How to fix or mitigate CVE-2025-4601?

Within 24 hours: Identify all WordPress sites using RH - Real Estate Theme versions up to 4.4.0 and disable the theme or restrict access to the inspiry_update_profile() function. Within 7 days: Upgrade to theme version 4.4.1 or later immediately. Within 30 days: Conduct a security audit of all user accounts to identify unauthorized administrative escalations and review access logs for suspicious activity.

PHP CVE-2025-4601

EUVD-2025-17621 HIGH

Improper Privilege Management (CWE-269)

2025-06-10 security@wordfence.com

WordPress Privilege Escalation PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17621

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profile() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their role to that of an administrator. The vulnerability was partially patched in version 4.4.0, and fully patched in version 4.4.1.

AnalysisAI

The RH - Real Estate WordPress Theme contains an Improper Access Control vulnerability (CWE-269) that allows authenticated subscribers and higher-privileged users to escalate their account privileges to administrator level through the inspiry_update_profile() function. All versions up to and including 4.4.0 are affected; versions 4.4.0 contain a partial patch while 4.4.1 provides complete remediation. With a CVSS score of 8.8 and network-based attack vector requiring only low-privilege authentication, this represents a critical privilege escalation risk for any WordPress installation using this theme.

Technical ContextAI

The vulnerability exists in the 'RH - Real Estate WordPress Theme' for WordPress (CPE identifier: wp:rh_real_estate_theme). The root cause is insufficient input validation and authorization controls within the inspiry_update_profile() WordPress theme function, which is responsible for updating user profile information. This function fails to properly restrict which user roles can be assigned during profile updates, violating CWE-269 (Improper Access Control / Validation). The vulnerability is classified as an insecure direct object reference (IDOR) derivative where role assignment parameters are not validated against the current user's privilege level. WordPress uses a role-based access control (RBAC) system; the theme should verify that only users with user management capabilities (typically administrators) can modify role assignments, but the function does not implement this check.

RemediationAI

Immediate Actions: (1) Update the RH - Real Estate WordPress Theme to version 4.4.1 or later immediately via WordPress Dashboard > Themes > Updates or by re-downloading from the vendor; (2) If version 4.4.1 is unavailable or vendor is non-responsive, temporarily disable public user registration (Settings > General > Membership) until patched; (3) Audit user roles and permissions - use WordPress admin dashboard (Users section) or WP-CLI (wp user list --role=administrator) to identify any unauthorized administrator accounts created during the vulnerability window; (4) Review WordPress activity logs and security plugins (Wordfence, Sucuri) for suspicious login activity or role escalation attempts. Workaround if immediate patching is impossible: Implement a Web Application Firewall (WAF) rule to filter requests to inspiry_update_profile() function or disable the profile update endpoint entirely via custom code. Long-term: Keep all WordPress themes and plugins updated, monitor vendor security advisories, and implement principle of least privilege for user roles.