CVE-2026-15142

Deferred Deferred - Pending Action

Privilege Escalation in Real Estate Manager Pro WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-20

Assigner: Wordfence

Description

The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-20

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-15142

EUVD

EUVD-2026-59597

Affected Vendors & Products

Vendor	Product	Version / Range
real_estate_manager_pro	real_estate_manager_pro	to 12.8.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Privilege Escalation flaw in the Real Estate Manager Pro WordPress plugin. It exists due to improper capability handling in the allow_attachment_actions() function. The flaw allows authenticated attackers with Subscriber-level access or higher to edit an administrator account by exploiting a mismatch where a user ID is treated as a media attachment ID during capability checks. This can lead to full privilege escalation to Administrator level.

Detection Guidance

This vulnerability can be detected by checking for unauthorized privilege changes in WordPress user accounts. Look for users with Subscriber-level access who have been granted Administrator privileges. Review the Real Estate Manager Pro plugin version; if it is 12.8.6 or lower, the system is vulnerable. Check WordPress logs for unusual activity related to user role modifications.

Impact Analysis

If you use the Real Estate Manager Pro plugin in WordPress with versions up to 12.8.6, an attacker with basic user access could exploit this flaw to gain full administrative control of your website. This could allow them to modify content, install malicious plugins, steal data, or take over your entire site.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized privilege escalation could result in data breaches, unauthorized data exposure, or loss of control over personal or protected health information.

Mitigation Strategies

Update the Real Estate Manager Pro plugin to the latest version beyond 12.8.6 immediately. If an update is not available, consider disabling the plugin until a patch is released. Review user accounts for unauthorized privilege changes and remove any suspicious administrator accounts.

Hi! I’m here to help you understand CVE-2026-15142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70