Introduction
One plugin misconfiguration can hand an attacker control of a whole WordPress site. CVE-2025-11985 shows how a missing capability check in a real estate plugin lets any authenticated user escalate to administrator. For anyone running a property listing site on WordPress, this puts the site at risk of full compromise with little attacker effort.
About Realty Portal: Realty Portal is a WordPress plugin for real estate professionals. It handles property listing management, agent profiles, and front-end submissions, and ships through the official WordPress plugin repository. It is not as widespread as WooCommerce, but real estate sites that want ready-made property management features often reach for it.
Technical Information
CVE-2025-11985 is a privilege escalation vulnerability caused by a missing authorization check (CWE-862) in the Realty Portal plugin for WordPress. The problem is in the rp_save_property_settings function, which is registered as an authenticated AJAX handler. The function is meant to let privileged users update property-related settings over AJAX. It never checks that the requesting user holds the right capability (such as manage_options) before it updates WordPress options.
The vulnerable function is reachable by any authenticated user, down to the lowest Subscriber role. An attacker sends a POST request to wp-admin/admin-ajax.php with the action parameter set to rp_save_property_settings and arbitrary option values in the request body. The dangerous part is what those options can be: set users_can_register to 1 to turn on public registration, and default_role to administrator so every new account becomes an admin. The attacker then registers an account with full administrative privileges and takes over the site.
The root cause is the absence of a current_user_can check before the call to update_option. The function should confirm that the user has the manage_options capability before it updates any option. This missing check is a well-known pitfall in WordPress plugin development.
Relevant code locations (from public sources):
Affected Systems and Versions
- Product: Realty Portal WordPress Plugin
- Affected Versions: 0.1 through 0.4.1 (inclusive)
- Any WordPress site running one of these versions, installed and activated, is vulnerable
- The vulnerability is present regardless of site configuration, as long as the plugin is active and user registration is possible
Vendor Security History
There is no public record of earlier security advisories for the Realty Portal plugin vendor. No official patch or vendor response has been released as of the publication date. The vendor's security maturity and response time are unclear.
