Inspirythemes
Monthly
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unprivileged attackers can gain administrative control of WordPress sites running InspiryThemes RealHomes up to version 4.4.0 by exploiting an incorrect privilege assignment vulnerability. No authentication or user interaction is required, leading to full site compromise with a CVSS 9.8 critical rating. While no active exploitation is known and EPSS probability is low, the flaw is reachable over the network if user registration is enabled.
Missing Authorization vulnerability in InspiryThemes RealHomes realhomes.3.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in InspiryThemes RealHomes realhomes.3.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unprivileged attackers can gain administrative control of WordPress sites running InspiryThemes RealHomes up to version 4.4.0 by exploiting an incorrect privilege assignment vulnerability. No authentication or user interaction is required, leading to full site compromise with a CVSS 9.8 critical rating. While no active exploitation is known and EPSS probability is low, the flaw is reachable over the network if user registration is enabled.
Missing Authorization vulnerability in InspiryThemes RealHomes realhomes.3.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in InspiryThemes RealHomes realhomes.3.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.