CVE-2025-11985 Overview
CVE-2025-11985 affects the Realty Portal plugin for WordPress in versions 0.1 through 0.4.1. The vulnerability stems from a missing capability check on the rp_save_property_settings function. Authenticated attackers with Subscriber-level access or above can update arbitrary WordPress options on the affected site. Attackers can exploit this flaw to enable open user registration and change the default registration role to administrator. This chain grants attackers full administrative control of the vulnerable WordPress installation. The flaw is classified as CWE-862: Missing Authorization.
Critical Impact
Authenticated Subscriber-level attackers can escalate privileges to administrator by modifying arbitrary WordPress options, leading to full site compromise.
Affected Products
- Realty Portal plugin for WordPress, version 0.1
- Realty Portal plugin for WordPress, versions 0.2 through 0.4
- Realty Portal plugin for WordPress, version 0.4.1
Discovery Timeline
- 2025-11-21 - CVE CVE-2025-11985 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11985
Vulnerability Analysis
The Realty Portal plugin exposes an AJAX endpoint that handles property settings through the rp_save_property_settings function. The function processes incoming requests and calls WordPress option update routines without verifying the caller's capabilities. Any authenticated user, including low-privileged Subscriber accounts, can invoke the endpoint and modify arbitrary options stored in the wp_options table. Attackers typically target two options: users_can_register to enable open registration, and default_role to set new accounts as administrators. After flipping these values, the attacker registers a new account and gains full administrative access to the WordPress site.
Root Cause
The handler omits a current_user_can() capability check before performing privileged actions. WordPress requires developers to call current_user_can() with an appropriate capability such as manage_options before mutating site configuration. The vulnerable code path in ajax-save-property-setting.php reaches the option update logic with only nonce-style validation, which is reachable by any logged-in user.
Attack Vector
An attacker first registers or obtains any low-privileged WordPress account on the target site. The attacker then sends an authenticated AJAX request to the rp_save_property_settings action with attacker-controlled option name and value parameters. The handler writes the supplied values directly via WordPress option update calls. The attacker submits two requests: one to set users_can_register to 1, and another to set default_role to administrator. The attacker then visits the registration page and creates a new administrator account. Refer to the Wordfence vulnerability report for additional technical context.
Detection Methods for CVE-2025-11985
Indicators of Compromise
- Unexpected changes to the users_can_register or default_role values in the wp_options table.
- New WordPress user accounts with the administrator role that were not provisioned by site operators.
- Web server access logs showing POST requests to admin-ajax.php with action=rp_save_property_settings from Subscriber-level sessions.
- Presence of the Realty Portal plugin at versions 0.1 through 0.4.1 on internet-facing WordPress sites.
Detection Strategies
- Audit the wp_options table for recent modifications to registration-related options and compare against known good baselines.
- Review WordPress user enumeration output for administrator accounts created after a low-privileged login event.
- Inspect plugin source under /wp-content/plugins/realty-portal/ for the affected AJAX handlers and confirm patch level.
Monitoring Recommendations
- Alert on any AJAX request containing action=rp_save_property_settings originating from non-administrator sessions.
- Track WordPress role changes and new administrator account creation events through audit log plugins or SIEM ingestion.
- Forward WordPress and web server logs into a centralized data lake to correlate option changes with session identity.
How to Mitigate CVE-2025-11985
Immediate Actions Required
- Update the Realty Portal plugin to a version newer than 0.4.1 once the vendor releases a patched release.
- Deactivate and remove the Realty Portal plugin if no fixed version is yet available for production sites.
- Review all administrator accounts and revoke any that cannot be attributed to legitimate provisioning.
- Reset users_can_register to 0 and default_role to subscriber if those values were altered.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry. Site operators should monitor the Realty Portal plugin page and the Wordfence advisory for an updated release that adds a capability check to the rp_save_property_settings handler.
Workarounds
- Block requests to admin-ajax.php with action=rp_save_property_settings at the web application firewall when the session role is below administrator.
- Disable user registration site-wide by setting users_can_register to 0 until a patched plugin is installed.
- Restrict subscriber registration on the site to reduce the pool of accounts that can reach authenticated AJAX endpoints.
- Apply file-level access controls to the plugin directory to prevent the AJAX handler from loading on production hosts.
# Configuration example - disable open registration via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate realty-portal
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
