Description

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T09:16:28.557Z",
  "pubdate": "2026-08-15T09:16:28.557Z",
  "executiveSummary": "The Real Estate Manager Pro plugin for WordPress, in all versions up to and including 12.8.6, contains a privilege escalation vulnerability that allows authenticated attackers with low privileges to compromise administrative accounts.\nThe vulnerability arises from improper capability handling within a specific attachment action validation routine, leading to logic flaws during user authorization checks.\nBy manipulating parameters to align user IDs with existing media attachment IDs, a malicious actor possessing Subscriber-level access or higher can alter targeted administrator accounts and elevate their own privileges to Administrator.\nThis severe security flaw poses critical risk implications for affected WordPress installations, as successful exploitation results in complete administrative takeover of the underlying web application.\nExploitation requires authenticated access with minimal privileges (Subscriber or above) and relies on specific conditions where a targeted user ID matches the numeric identifier of an existing media attachment.",
  "technicalDetails": "The vulnerability stems from improper capability handling located within the allow_attachment_actions() function of the Real Estate Manager Pro plugin.\nThe affected component fails to strictly distinguish between a target user ID and a media attachment ID during critical authorization and capability verification routines.\nThis logic flaw permits an authenticated attacker with low-privileged access, such as a Subscriber, to bypass intended authorization boundaries by supplying a user ID that corresponds numerically to an existing media attachment ID.\nDuring the execution flow, the vulnerable allow_attachment_actions() function evaluates the supplied identifier incorrectly, treating the target user record as if it were a media attachment undergoing modification.\nConsequently, the security controls fail to prevent unauthorized modifications to administrative accounts.\nThe attack flow proceeds as follows: First, the authenticated attacker identifies a valid administrator account whose user ID coincides with the ID of an existing media attachment within the WordPress media library.\nSecond, the attacker crafts a request targeting the user profile update functionality influenced by the vulnerable function.\nThird, the improper capability checks process the input, granting the low-privileged attacker unauthorized authorization to edit the targeted administrator account.\nFinally, the attacker modifies the account details or assigns administrative privileges to their own session, successfully escalating their access level to Administrator.\nThis vulnerability affects all versions of the Real Estate Manager Pro plugin up to and including 12.8.6.\nThe attack vector requires network exposure via the WordPress frontend or backend, authenticated access at the Subscriber level or higher, and the prerequisite condition where the targeted user ID matches a media attachment ID."
}