CVE-2025-4601: Flaw Exposes 33,000+ RealHomes WordPress Sites to Admin Takeover

A critical Privilege Escalation vulnerability has been disclosed in the RealHomes WordPress theme, a popular real estate template with over 33,000 sales on ThemeForest. Tracked as CVE-2025-4601 and carrying a CVSS score of 8.8, this vulnerability could allow low-privilege users to escalate their roles to administrator, potentially compromising an entire site.

“This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to grant themselves administrative privileges by updating their user role,” Wordfence researchers warned.

The issue resides in the inspiry_update_profile() function, which is responsible for updating user profile information. If the “Show user role option in profile” setting is enabled—disabled by default—then attackers can modify their own user role without restriction.

A snippet of the affected code reveals the core problem:

// Changing user role if allowed to
if ( get_option( 'ere_allow_users_change_role', false ) && ! empty( $_POST['realhomes_user_role'] ) ) {
 
    // Getting selected user role
    $selected_role = $_POST['realhomes_user_role'];
 
    // Get the user data
    $user_data = get_userdata( $current_user->ID );
 
    // Check if the user data is found
    if ( $user_data ) {
        // Update the user role
        $user_data->set_role( $selected_role );

“The most significant problem and vulnerability is caused by the fact that there are no restrictions on the user role,” Wordfence notes. “So the user’s role can be updated arbitrarily, even to ‘administrator’.”

Once an attacker gains admin rights on a WordPress site, total compromise is possible. This includes:

• Uploading malicious plugins or theme files
• Injecting backdoors
• Modifying or deleting content
• Redirecting site visitors to malicious sites
• Inserting spam or phishing pages

“As with any Privilege Escalation vulnerability, this can be used for complete site compromise,” the report confirms.

The attack chain could begin with as little as a subscriber-level account, which is commonly used on community-driven real estate listings, making it a potentially highly exploitable vector in the wild.

The developers of RealHomes have released version 4.4.1, which addresses the vulnerability. Wordfence urges all users to update immediately, especially those who may have enabled the vulnerable setting.

Related Posts:

• WordPress Issues Urgent Security Update to Patch Multiple Vulnerabilities
• Splunk Patches Critical Vulnerabilities, Including Remote Code Execution Flaws