CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Explanation of Vulnerability in Simple Terms
Realteo versions 1.2.8 and earlier contain a privilege management flaw that allows unauthenticated attackers to gain full control over the application. The vulnerability requires no user interaction and can be exploited remotely over the network. An attacker can read, modify, or delete any data and disrupt service availability.
What an attacker can do
Read, modify, or delete any data; disrupt service availability; gain full administrative control without authentication.
Potential impact on your site
Complete compromise of the Realteo installation; all data at risk; attackers can modify or delete content and disable the site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
