Property – Real Estate Directory Listing
Approved changes feed: RSS · Atom
cpe:2.3:a:themeglow:property_–_real_estate_directory_listing:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Themeglow (6a1cdbe7-6092-5434-8e6b-15132771ac49) |
|---|---|
| Product | Property – Real Estate Directory Listing (c3c70a7e-cf81-5238-adeb-d3fb1fdf4e97) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5117 |
vulnerable | 2026-06-08 07:35:24.187477 |
Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration
HIGH (8.8)
The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package_user_role metadata in versions 1.0.5 to 1.0.6. This makes it possible for authenticated attackers, with Author‐level access and above, to elevate their privileges to that of an administrator by creating a package post whose property_package_user_role is set to administrator and then submitting the PayPal registration form.
Published: 2025-05-27T11:14:26.964Z
Updated: 2025-05-27T13:05:07.985Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.