Resideo Plugin for WordPress Privilege Escalation Vulnerability via Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the Resideo Plugin for the Resideo - Real Estate WordPress Theme. This vulnerability affects all versions through 2.5.4. The issue arises because the plugin fails to properly validate a user's identity before allowing changes to account details such as email addresses. As a result, authenticated attackers with Subscriber-level access or higher can manipulate email addresses of other users, including administrators. This exploitation can be used to reset passwords and gain unauthorized access to those accounts.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including those of administrators, by leveraging an insecure direct object reference to bypass authorization controls.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.