CVE-2025-6190: Privilege Escalation Vulnerability in Realty Portal – Agent Plugin for WordPress

Overview

The cybersecurity landscape is constantly evolving, with new threats and vulnerabilities emerging on a regular basis. One such vulnerability, named CVE-2025-6190, exposes users of the Realty Portal – Agent plugin for WordPress to a severe risk of privilege escalation attacks. This vulnerability is due to missing authorization within a specific AJAX handler in the plugin.
The Realty Portal – Agent plugin is widely used by real estate portals on WordPress to manage agents, making this a critical issue that could potentially affect a large number of websites and their users. The risk is high as it allows attackers with low-level access to potentially elevate their privileges and gain full administrative control over the affected sites.

Vulnerability Summary

CVE ID: CVE-2025-6190
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access)
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Realty Portal – Agent Plugin for WordPress | 0.1.0 through 0.3.9

How the Exploit Works

The exploit leverages a lack of authorization in the rp_user_profile() AJAX handler in the Realty Portal – Agent plugin for WordPress. The handler reads the client-supplied meta key and value pairs from $_POST and passes them directly to update_user_meta() without restricting to a safe whitelist.
This allows an attacker, even with minimal Subscriber-level access, to overwrite the wp_capabilities meta and grant themselves the administrator role. With the administrator role, the attacker can manipulate the site, potentially leading to system compromise or data leakage.

Conceptual Example Code

Here’s a conceptual example of how the vulnerability might be exploited:

POST /wp-admin/admin-ajax.php?action=rp_user_profile HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
meta_key=wp_capabilities&meta_value=a:1:{s:13:"administrator";b:1;}

In this example, an HTTP POST request is made to the vulnerable AJAX handler, with the meta_key set to ‘wp_capabilities’ and the meta_value set to give the attacker administrative privileges.
This is just a conceptual example to illustrate the nature of the vulnerability. The actual exploitation might be more complex and could involve additional steps or precautions to avoid detection.

Mitigation Measures

The most effective way to mitigate this vulnerability is to apply the vendor’s patch as soon as it is available. If a patch is not yet available, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. These systems can be configured to block or alert on suspicious activity related to this vulnerability, such as attempts to modify the ‘wp_capabilities’ meta.
Users of the Realty Portal – Agent plugin for WordPress are advised to monitor their systems closely for any signs of compromise, and to apply the vendor’s patch as soon as it is available.