RH Real Estate WordPress Theme Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in the RH - Real Estate WordPress Theme, affecting all versions through 4.4.0. The issue arises because the theme's inspiry_update_profile() function does not properly manage user role permissions. This flaw allows authenticated users with subscriber-level access or higher to elevate their roles to administrator. While version 4.4.0 addressed part of this vulnerability, it was not until version 4.4.1 that a complete fix was implemented.

Impact

Exploitation of this vulnerability allows authenticated users with subscriber-level access and above to gain administrator privileges, potentially leading to unauthorized changes and access within the WordPress site.

Remediation

Users are advised to update the RH - Real Estate WordPress Theme to version 4.4.1 or later.