CVE-2025-49867
BaseFortify
Publication date: 2025-07-04
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| inspirythemes | realhomes | to 4.4.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49867 is a high-severity privilege escalation vulnerability in the WordPress RealHomes theme (up to version 4.4.0). It allows an unauthenticated attacker with low privileges to escalate their access rights to higher privileges, potentially gaining full control over the affected website. This flaw is classified under OWASP Top 10 category A5: Security Misconfiguration. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to gain full control over your website by escalating their privileges from low or no access to administrative levels. This can lead to unauthorized changes, data theft, site defacement, or further compromise of your server and data. The high CVSS score of 9.8 indicates a critical risk with a high likelihood of mass exploitation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or detailed methods to detect this vulnerability on your network or system. Patchstack recommends professional incident response and server-side malware scanning in case of compromise, but no explicit detection commands are given. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the virtual patch (vPatch) provided by Patchstack to block attack attempts until you can update. The vulnerability is fixed in RealHomes theme version 4.4.1 and later, so updating to version 4.4.1 or above is strongly advised to fully remediate the issue. [1]