CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
Explanation of Vulnerability in Simple Terms
WP Real Estate Manager versions 2.8 and earlier contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the plugin without valid credentials, potentially compromising sensitive real estate data and site functionality. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update immediately to a patched version.
What an attacker can do
Gain unauthorized access to the plugin and read or modify real estate listings and sensitive data without credentials.
Potential impact on your site
Attackers can access and modify real estate data, compromise site integrity, and potentially take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
