Privilege Escalation Vulnerability in Real Estate Manager Pro Plugin for WordPress

CVE-2026-15142

What is CVE-2026-15142?

The Real Estate Manager Pro plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to escalate their privileges. This issue stems from improper handling of user capabilities in the allow_attachment_actions() function. By exploiting this flaw, attackers can manipulate user ID checks, enabling them to edit an administrative account if the targeted user ID corresponds to an existing media attachment. This leads to unauthorized administrative access, creating significant security risks for WordPress sites utilizing this plugin.

References