Executive Summary

This vulnerability exists in the Realty Portal plugin for WordPress (versions 0.1 to 0.4.1) where a missing capability check on the 'rp_save_property_settings' function allows authenticated users with Subscriber-level access or higher to modify arbitrary options on the WordPress site. Attackers can exploit this to escalate their privileges by changing the default user role to administrator and enabling user registration, thereby gaining administrative access to the site.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers with low-level access to escalate their privileges to administrator, potentially taking full control of the WordPress site. This can lead to unauthorized changes, data manipulation, and complete compromise of the website's security and functionality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Realty Portal plugin to a version later than 0.4.1 where the missing capability check is fixed. Additionally, review and restrict user roles and permissions, especially ensuring that Subscriber-level users cannot modify critical settings. Disable user registration if not needed to prevent attackers from creating administrative accounts.

Useful 0 Not Useful 0