Introduction
Attackers can achieve remote code execution on real estate websites running WPCasa for WordPress, and they do not need to authenticate first. WPCasa is a widely used property management plugin, so every site on an affected version puts sensitive business and client data at risk.
WPSight develops WPCasa, a real estate management plugin for WordPress. Thousands of real estate professionals and agencies use it to manage property listings, searches, and agent profiles. It is available in the official WordPress repository, and many real estate websites are built on it.
Technical Information
CVE-2025-9321 is a code injection vulnerability in every version of the WPCasa plugin for WordPress up to and including 1.4.1. The root cause is insufficient input validation and restriction in the 'api_requests' function, in includes/class-wpsight-api.php at or near line 48 (reference).
The function processes API requests from external sources and does not properly sanitize their input. An unauthenticated attacker can send crafted HTTP requests to the plugin's API endpoints carrying arbitrary function calls or code payloads, and the plugin executes them on the server. This is a case of CWE-94 (Improper Control of Code Generation), in which user input reaches a code execution context without adequate validation.
The official advisories do not include a public code snippet, but the vulnerability is confirmed to be in the API handling logic. Because exploitation needs no authentication, attackers can trivially automate attacks against any publicly accessible WordPress site running a vulnerable version of WPCasa.
Affected Systems and Versions
- Product: WPCasa WordPress plugin
- Versions affected: All versions up to and including 1.4.1
- Any WordPress site with WPCasa 1.4.1 or earlier is vulnerable
Vendor Security History
WPSight, the developer of WPCasa, makes a range of real estate plugins and themes for WordPress and maintains active documentation and support channels. No prior critical vulnerabilities appear in the provided materials. Even so, a flaw this long-standing shows that its input validation and code review processes need to improve.
