Privilege Escalation Vulnerability in Property Plugin for WordPress

CVE-2025-5117

What is CVE-2025-5117?

The Property plugin for WordPress lacks a necessary capability check on the property_package_user_role metadata, allowing authenticated users with Author-level access and above to escalate their permissions. Attackers can exploit this vulnerability by creating a package post with the property_package_user_role set to administrator. Subsequently, they can submit the PayPal registration form, granting them administrative access unlawfully.

References