EUVD-2026-59597
GHSA-4hr2-j36x-6gwm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H for the required admin-user-ID-to-attachment-ID collision; PR:L for mandatory Subscriber authentication; full C/I/A:H because Administrator takeover yields complete site control.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
AnalysisAI
Privilege escalation in the Real Estate Manager Pro WordPress plugin (all versions ≤ 12.8.6) allows authenticated Subscriber-level users to seize full Administrator control of a WordPress site. The flaw in allow_attachment_actions() confuses WordPress user IDs with media attachment IDs during capability checks, enabling a low-privileged user to edit an administrator account when those integer IDs collide. No confirmed active exploitation (CISA KEV) has been recorded, but the Subscriber-level access bar makes this a practical threat on any multi-user WordPress installation where the plugin is deployed.
Technical ContextAI
The Real Estate Manager Pro plugin for WordPress exposes a function named allow_attachment_actions() that performs capability checks against a supplied ID. WordPress stores both users (in wp_users) and media attachments (in wp_posts with post_type='attachment') as independent objects that share the same integer auto-increment ID space, meaning user ID 5 and attachment ID 5 are distinct objects but numerically identical. CWE-269 (Improper Privilege Management) captures the root cause: the function incorrectly resolves the supplied ID against the media attachment context rather than the user context, so capability checks pass for the wrong object. An attacker who identifies an administrator whose user ID matches any existing media attachment ID can exploit this type confusion to perform a privilege escalation via the user-editing code path. No CPE string was supplied in the intelligence data, but the affected scope is the plugin across all versions through 12.8.6.
RemediationAI
Administrators should update Real Estate Manager Pro to the latest available version via the vendor changelog at https://wp-rem.com/changelog/; the exact patched release version is not independently confirmed from the available intelligence data, so the changelog should be reviewed to identify the first release that addresses CVE-2026-15142. As an interim compensating control, disabling open user registration (Settings > General > uncheck 'Anyone can register' in WordPress) removes the ability for untrusted parties to obtain Subscriber accounts, which is the required starting privilege - note this does not protect against already-registered Subscriber accounts. Auditing and removing untrusted Subscriber-level accounts from the WordPress user list further reduces exposure. Wordfence users should ensure their firewall rules are up to date, as Wordfence may deploy virtual patching for this vulnerability. Reducing the media library size to lower ID-collision probability is not a reliable standalone control and should not be relied upon.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today