CVE-2025-2232

CRITICAL

Realteo < 1.2.8 - Unauthenticated Authentication Bypass via do_register_user Function

Title source: llm
STIX 2.1

Description

The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0051
EPSS Percentile 39.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269
Status published
Products (2)
PureThemes/Realteo < 1.2.8
purethemes/realteo < 1.2.9
Published Mar 14, 2025
Tracked Since Feb 18, 2026