by Kastro
Paper/Archive/CVE-2025-6758

CVE-2025-6758

imithemes Real Spaces - WordPress Properties Directory Theme — Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.4.314 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.

Affected

ProductAffectedFixed inSource
Real Spaces - WordPress Properties Directory Theme≤ 3.6–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/e2b24858-dfcd-46f3-9552-c7acc63a1ee7?source=cverefthemeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779