EUVD-2025-17621
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiry_update_profile() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their role to that of an administrator. The vulnerability was partially patched in version 4.4.0, and fully patched in version 4.4.1.
Analysis
The RH - Real Estate WordPress Theme contains an Improper Access Control vulnerability (CWE-269) that allows authenticated subscribers and higher-privileged users to escalate their account privileges to administrator level through the inspiry_update_profile() function. All versions up to and including 4.4.0 are affected; versions 4.4.0 contain a partial patch while 4.4.1 provides complete remediation. With a CVSS score of 8.8 and network-based attack vector requiring only low-privilege authentication, this represents a critical privilege escalation risk for any WordPress installation using this theme.
Technical Context
The vulnerability exists in the 'RH - Real Estate WordPress Theme' for WordPress (CPE identifier: wp:rh_real_estate_theme). The root cause is insufficient input validation and authorization controls within the inspiry_update_profile() WordPress theme function, which is responsible for updating user profile information. This function fails to properly restrict which user roles can be assigned during profile updates, violating CWE-269 (Improper Access Control / Validation). The vulnerability is classified as an insecure direct object reference (IDOR) derivative where role assignment parameters are not validated against the current user's privilege level. WordPress uses a role-based access control (RBAC) system; the theme should verify that only users with user management capabilities (typically administrators) can modify role assignments, but the function does not implement this check.
Affected Products
Affected Product: RH - Real Estate WordPress Theme; Affected Versions: All versions up to and including 4.4.0; CPE: wp:rh_real_estate_theme:*:* (versions through 4.4.0); Safe Version: 4.4.1 and later. Specific version ranges vulnerable: 1.0.0 through 4.4.0 (inclusive). Partial mitigation in 4.4.0 indicates users on 4.4.0 remain at residual risk and must upgrade to 4.4.1. WordPress installations with this theme installed and public user registration enabled are at highest risk.
Remediation
Immediate Actions: (1) Update the RH - Real Estate WordPress Theme to version 4.4.1 or later immediately via WordPress Dashboard > Themes > Updates or by re-downloading from the vendor; (2) If version 4.4.1 is unavailable or vendor is non-responsive, temporarily disable public user registration (Settings > General > Membership) until patched; (3) Audit user roles and permissions - use WordPress admin dashboard (Users section) or WP-CLI (wp user list --role=administrator) to identify any unauthorized administrator accounts created during the vulnerability window; (4) Review WordPress activity logs and security plugins (Wordfence, Sucuri) for suspicious login activity or role escalation attempts. Workaround if immediate patching is impossible: Implement a Web Application Firewall (WAF) rule to filter requests to inspiry_update_profile() function or disable the profile update endpoint entirely via custom code. Long-term: Keep all WordPress themes and plugins updated, monitor vendor security advisories, and implement principle of least privilege for user roles.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today