CVE-2025-6758
CRITICALImithemes Real Spaces - WordPress Properties Directory Theme <= 3.6 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2025-6758. PoCs published by adminlove520, Boshe99, Nxploited.
AI-analyzed exploit summary The repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate the vulnerabilities with clear technical details and executable scripts.
Description
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.
Exploits (3)
The repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate the vulnerabilities with clear technical details and executable scripts.
The repository contains functional exploit code for CVE-2025-6758, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
This repository contains a functional Python exploit for CVE-2025-6758, targeting a WordPress registration vulnerability. The script automates nonce extraction, payload construction, and user registration with elevated privileges.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H