Critical Security Flaws Discovered in RealHome Theme and Plugin, Awaiting Patches

WordPress administrators managing real estate websites using the RealHome Theme and its associated plugin, Easy Real Estate, are urged to secure their sites due to unpatched vulnerabilities. Researchers from Patchstack have identified critical security flaws in the theme and plugin, which pose significant risks to websites.

RealHome Theme and Plugin Vulnerabilities Remain Unpatched

Patchstack researchers discovered two major vulnerabilities in the RealHome Theme and the Easy Real Estate plugin that could jeopardize website security:

CVE-2024-32444 (Critical severity, CVSS 9.8):

A lack of nonce checks in the code handling user inputs allows privilege escalation in the RealHome Theme. Malicious actors can exploit this to create new admin accounts by abusing the inspiry_ajax_register action with a $user_role parameter. This oversight enables unauthorized attackers to gain full control of affected websites.

CVE-2024-32555 (Critical severity, CVSS 9.8):

Another privilege escalation vulnerability exists in the ere_social_register() function of the Easy Real Estate plugin. This flaw allows an attacker to log in as the site admin using only the admin email address—bypassing password verification entirely. This vulnerability impacts plugin version 4.3.3.

Despite being informed promptly about these flaws, the developers at InspiryThemes have not issued patches at the time of writing. This delay exposes all websites using the theme and plugin to potential exploits.

Recommended Mitigations

Until patched versions are released, administrators are advised to:

1. Disable the RealHome Theme and Easy Real Estate plugin immediately to avoid exploitation.

2. Implement strict input validation for functions like wp_set_auth_cookie(), wp_update_user(), and update_user_meta().

3. Restrict the creation of user accounts to prevent the creation of unauthorized admin accounts.

These proactive measures can help mitigate risks until secure updates are available. Administrators should remain vigilant and monitor updates from the developers closely.

What do you think about this situation? Share your thoughts below.