CVE-2025-24698: G5plus Essential Real Estate CSRF Flaw

CVE-2025-24698 Overview

CVE-2025-24698 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the g5plus Essential Real Estate plugin for WordPress. The flaw affects all versions up to and including 5.1.8. An attacker can craft a malicious web page that, when visited by an authenticated site user, triggers unintended state-changing actions in the plugin. Exploitation requires user interaction but no attacker privileges, and it can be triggered remotely over the network.

Critical Impact
Successful exploitation allows attackers to perform unauthorized actions on behalf of authenticated WordPress users, resulting in limited integrity impact on the affected site.

Affected Products

g5plus Essential Real Estate WordPress plugin versions through 5.1.8
WordPress sites running the essential-real-estate plugin
Deployments where administrators or privileged users browse untrusted content

Discovery Timeline

2025-01-24 - CVE-2025-24698 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24698

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens on state-changing endpoints in the Essential Real Estate plugin. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer() to bind requests to a user session. When plugin handlers omit or fail to verify these nonces, the browser will automatically attach the victim's authentication cookies to any cross-origin request, allowing attacker-controlled pages to invoke privileged actions.

The issue is scoped to the plugin's own request handlers and does not impact confidentiality directly. However, integrity is affected because plugin state, real estate listings, or plugin configuration values may be modified without the user's explicit consent. Exploitation requires the victim to visit an attacker-controlled page while authenticated to the target WordPress instance.

Root Cause

The root cause is insufficient request origin validation in one or more plugin action handlers. The handlers accept requests based solely on the victim's session cookie without verifying a unique per-request token, violating the CSRF protection model documented in the WordPress Plugin Handbook.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting form or JavaScript that targets a vulnerable plugin endpoint on the victim's WordPress site. When an authenticated administrator or privileged user loads the page, the browser sends the forged request with valid session cookies. The plugin processes the request as if it were legitimate. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-24698

Indicators of Compromise

Unexpected modifications to real estate listings, agent profiles, or plugin settings that do not correspond to legitimate administrator activity.
HTTP POST requests to Essential Real Estate plugin endpoints with Referer headers pointing to external, untrusted domains.
Requests to plugin action handlers that lack a valid _wpnonce parameter in server access logs.

Detection Strategies

Review web server access logs for POST requests to /wp-admin/admin-ajax.php and Essential Real Estate action endpoints originating from off-site referrers.
Enable WordPress audit logging to record plugin configuration and content changes with the initiating user and source IP.
Correlate authenticated administrator sessions with the exact page navigation history to identify forged actions.

Monitoring Recommendations

Alert on plugin setting changes occurring outside expected administrator working windows.
Monitor the plugin version in use across managed WordPress deployments and flag installations running 5.1.8 or earlier.
Track outbound referrers on administrative requests using a web application firewall (WAF) in monitoring mode.

How to Mitigate CVE-2025-24698

Immediate Actions Required

Update the Essential Real Estate plugin to a version later than 5.1.8 as soon as a patched release is available from g5plus.
Audit recent plugin configuration and content changes for unauthorized modifications.
Require administrators to log out of WordPress sessions when browsing untrusted content.

Patch Information

At the time of NVD publication, the advisory tracks the issue as affecting versions through 5.1.8. Refer to the Patchstack Vulnerability Report for the current fixed version and vendor patch status.

Workarounds

Deploy a WAF rule that blocks state-changing requests to the plugin when the Referer or Origin header does not match the site's own domain.
Restrict access to /wp-admin/ by IP allowlist for administrative users where feasible.
Temporarily deactivate the Essential Real Estate plugin on affected sites until a fixed version is installed.

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to plugin endpoints
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1002498,phase:1,deny,status:403,msg:'CSRF: cross-origin POST to Essential Real Estate'"
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php|/essential-real-estate/" \
  "chain"
SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example" \
  "t:none"