WordPress security changelog
CRITICAL CVE-2025-49867 Modified

RealHomes: Privilege escalation or authentication bypass

RealHomes is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 9.8 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
RealHomes
Plugin slug
realhomes
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jul 04, 2025
Weakness
CWE-266 — Incorrect Privilege Assignment

This CVE was published Jul 04, 2025 and is one of 5 known issues for this theme.

What to do

Patch or disable the affected component.

Update RealHomes to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.4.0.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources