What is the CVSS score of CVE-2026-54827?

CVE-2026-54827 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Real Estate 7 are affected by CVE-2026-54827?

The Real Estate 7 WordPress theme contains a critical SQL injection vulnerability (CVE-2026-54827, CVSS 9.3) affecting all versions through 3.5.9 that allows unauthenticated remote attackers to…

How to fix or mitigate CVE-2026-54827?

Within 24 hours: Inventory all WordPress installations using Real Estate 7 theme versions ≤3.5.9; identify and document affected sites and data scope. Within 7 days: Deactivate and delete the vulnerable theme from all production systems; if operational constraints prevent immediate removal, deploy Web Application Firewall (WAF) rules to block SQL injection attack patterns in theme request parameters. Within 30 days: Monitor Patchstack and Real Estate 7 official channels for vendor patch release; apply patch to all instances upon availability after staging validation.

Real Estate 7 CVE-2026-54827

EUVD-2026-39674 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-4vhp-x3jq-9qc4

WordPress SQLi Wordpress Theme

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated remote SQLi gives low-complexity DB read (C:H); no evidence of write/integrity or availability impact, and I treat the database as the same authorization scope (S:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:34 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

AnalysisAI

SQL injection in the Real Estate 7 WordPress theme (versions up to and including 3.5.9) lets unauthenticated remote attackers inject malicious SQL through an unsanitized parameter, exposing backend database contents. The CVSS 3.1 base score is 9.3 (S:C/C:H) driven by the scope change and high confidentiality impact, with no authentication or user interaction required. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported through Patchstack's vulnerability research program.

Technical ContextAI

Real Estate 7 is a premium WordPress theme used to build property-listing and real-estate agency websites, running inside the standard WordPress/PHP stack on top of a MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): attacker-controlled input reaches a database query without proper parameterization or escaping, allowing query structure to be altered. Because the input is reachable pre-authentication, any theme endpoint, AJAX action, or search/filter handler that builds dynamic SQL from request parameters is a candidate sink. No CPE strings were supplied in the input, so exact affected components beyond the theme name/version are not enumerated.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range (<= 3.5.9) implies a later release should contain the fix, but that version is not confirmed here, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/realestate-7/vulnerability/wordpress-real-estate-7-theme-3-5-9-sql-injection-vulnerability?_s_id=cve) and the theme vendor for the exact patched build and upgrade to it as the primary fix. As compensating controls until patched: deploy a WordPress/WAF rule (Patchstack, Wordfence, or equivalent) with virtual patching for this CVE and generic SQLi signatures, which adds latency/false-positive tuning overhead; restrict or disable the specific theme search/filter or AJAX endpoint that accepts the injectable parameter if it can be identified, accepting loss of that front-end feature; and place the site behind authentication or IP allowlisting for non-public deployments, which breaks public browsing if the site must remain open. Enforce least-privilege on the MySQL account used by WordPress (remove FILE/admin privileges) to limit the blast radius of any successful injection.