Executive Summary
A high-severity Privilege Escalation vulnerability (CVE-2026-15142) has been disclosed in the Real Estate Manager Pro plugin for WordPress. The flaw carries a CVSS score of 7.5 and allows attackers to escalate their privileges on affected WordPress installations through a capability handling bug in the plugin's allow_attachment_actions() function.
CVSS Score: 7.5 (High)
The vulnerability stems from improper capability checking logic in the allow_attachment_actions() function, which incorrectly treats a target user ID as a media attachment ID during user capability checks. This confusion allows attackers to bypass intended access controls and perform actions they are not authorized to execute, potentially granting themselves elevated privileges on the WordPress site.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-15142 |
| CVSS Score | 7.5 (High) |
| Type | Improper Privilege Management / Capability Bypass |
| Attack Vector | Network |
| Privileges Required | Low |
| User Interaction | None |
| Affected Plugin | Real Estate Manager Pro ≤ 12.8.6 |
Affected Versions
| Plugin | Affected Versions | Status |
|---|---|---|
| Real Estate Manager Pro | All versions ≤ 12.8.6 | Patch required |
Technical Details
WordPress uses a capability system to control what actions different user roles can perform. The allow_attachment_actions() function in Real Estate Manager Pro is designed to determine whether a user has permission to perform attachment-related operations.
The bug is a type confusion error: the function receives a target user ID but mistakenly evaluates it as if it were a media attachment ID when performing the capability check. Because attachment IDs and user IDs occupy different namespaces in WordPress, the check resolves against the wrong object, causing it to return an incorrect (permissive) authorization decision.
Attack Sequence
1. Attacker holds a low-privileged account (e.g., subscriber, agent role)
2. Attacker calls allow_attachment_actions() with their own user ID as attachment ID
3. Capability check evaluates against attachment object instead of user object
4. Authorization check incorrectly passes due to ID namespace confusion
5. Attacker performs actions beyond their intended privilege level
6. Potential path to administrator role depending on available escalation pathsImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Privilege Escalation | Bypass role-based access controls |
| Unauthorized Data Access | Access property listings and user contact data |
| Configuration Manipulation | Modify plugin or site settings beyond allowed scope |
| Pathway to Admin | Depending on attack chain, escalation to administrator |
| Data Integrity Risk | Modify or delete listing data outside permitted scope |
Immediate Remediation
Step 1: Update Real Estate Manager Pro
# Via WP-CLI
wp plugin update real-estate-manager
# Verify installed version
wp plugin get real-estate-manager --field=versionOr update through WordPress admin: Plugins > Installed Plugins > Real Estate Manager Pro > Update Now.
Step 2: Audit User Roles and Capabilities
# List all users with elevated roles
wp user list --fields=ID,user_login,user_email,roles
# Check for unauthorized role assignments
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
# Audit capability overrides stored in user meta
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value LIKE '%administrator%';"Step 3: Remove Unauthorized Role Escalations
# Downgrade any unauthorized administrator accounts
wp user remove-role <user_id> administrator
wp user add-role <user_id> subscriber
# Force password reset for suspicious accounts
wp user update <user_id> --user_pass=$(openssl rand -base64 16)Step 4: Restrict Plugin-Level Access
If immediate patching is not possible, consider restricting access to the plugin's functionality:
- Disable Real Estate Manager Pro until a patch can be applied
- Block API endpoint access for low-privileged roles at the WAF level
- Monitor for unusual capability requests in server access logs
Detection Indicators
| Indicator | Description |
|---|---|
| Low-privileged users accessing admin functionality | Active exploitation attempt |
Unexpected user role changes in wp_usermeta | Successful privilege escalation |
| Unusual access patterns to property management endpoints | Recon or exploitation activity |
| New administrator accounts not created by site owners | Post-exploitation persistence |
Post-Remediation Steps
- Update Real Estate Manager Pro to the patched version
- Audit all user accounts and their assigned roles
- Revert any unauthorized role escalations discovered
- Force password resets on accounts with suspicious activity
- Enable logging for capability check failures
- Deploy a WAF with WordPress-aware rulesets
- Implement role-based access monitoring for ongoing protection