Real Estate Manager Pro CVE-2026-15142

Exploitation requires an authenticated WordPress account at Subscriber level or higher on a site running Real Estate Manager Pro version 12.8.6 or earlier. The decisive prerequisite is that the targeted administrator's WordPress user ID must numerically match the ID of an existing media attachment in the site's wp_posts table - for example, if the administrator has user ID 3, attachment post ID 3 must exist. This ID-collision condition is the primary limiting factor: freshly installed sites or sites where admin user IDs do not overlap with any attachment IDs are not exploitable. Sites with large media libraries and low-numbered admin accounts (e.g., the default admin at user ID 1 with at least one uploaded media file registered as attachment ID 1) present the most exploitable configurations. No user interaction from the administrator is required, and no elevated starting role beyond a basic registered account is needed.

The NVD-assigned CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.5 (High). The AC:H rating is technically justified: exploitation depends on the administrator's user ID numerically matching an existing media attachment ID, a coincidence more likely on established sites with large media libraries but not guaranteed. PR:L correctly reflects that only a basic registered Subscriber account is needed - no elevated starting role. The impact triad of C:H/I:H/A:H is appropriate because a successful escalation to Administrator grants unrestricted control over the WordPress instance. No EPSS score was included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified independently. This CVE is not listed in CISA KEV, and no public POC has been identified at time of analysis, which collectively lowers real-world urgency relative to the raw CVSS. That said, even a mid-sized municipal IT team in sanok running public-facing WordPress sites with subscriber registration enabled should treat this as urgent, because the ID-collision condition is discoverable through enumeration and the payoff - full site Administrator access - is severe. The primary limiting factor separating this from a trivially exploitable privilege escalation is the AC:H collision prerequisite.

An attacker registers a free Subscriber account on a vulnerable WordPress site. They enumerate the site's administrator user ID - typically ID 1 on default installs - and confirm that a media attachment with the same integer ID exists in the site's library (easily discoverable via direct media URL probing or WordPress REST API). They then submit a crafted HTTP request targeting the administrator's account through the Real Estate Manager Pro plugin, triggering the ID confusion in allow_attachment_actions() which passes the capability check against the attachment rather than the user, allowing the attacker to elevate their own role to Administrator.