CVE-2024-13421

CRITICAL 9.8

Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.

CWE	CWE-266
Vendor	contempoinc
Product	real estate 7 wordpress
Published	Feb 12, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for contempoinc real estate 7 wordpress

Be the first to know when new critical vulnerabilities affecting contempoinc real estate 7 wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

contempoinc / Real Estate 7 WordPress

0 ≤ 3.5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve themeforest.net: https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778 contempothemes.com: https://contempothemes.com/changelog/

Credits

Lucio Sá