Paper/Archive/CVE-2024-13421

CVE-2024-13421

contempoinc Real Estate 7 WordPress — Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.8.558 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.

Affected

ProductAffectedFixed inSource

Real Estate 7 WordPress≤ 3.5.1–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve refthemeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778 refcontempothemes.com/changelog