The Real Spaces – WordPress Properties Directory Theme for WordPress is vulnerable to privilege escalation via the ‘change_role_member’ parameter in all versions up to and including 3.5. This vulnerability arises from a lack of restriction in the profile update role, allowing unauthenticated attackers to arbitrarily select their role, including the Administrator role, during a profile update.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-8218 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted request to the profile update endpoint of the Real Spaces theme, using the ‘change_role_member’ parameter to specify a desired role. Since there are no restrictions in place, the attacker can elevate their privileges to that of an Administrator, gaining full control over the WordPress site.
Affected Products
- Real Spaces – WordPress Properties Directory Theme: A theme for WordPress that allows users to manage property listings, which is vulnerable to privilege escalation.
Mitigation
To mitigate this vulnerability, it is recommended to update the Real Spaces theme to the latest version where this issue has been addressed. Additionally, implementing role-based access controls and regularly reviewing user permissions can help prevent unauthorized privilege escalation.