CVE-2025-2891: Real Estate 7 WordPress Theme RCE Vulnerability

CVE-2025-2891 Overview

CVE-2025-2891 affects the Real Estate 7 WordPress theme developed by Contempo Themes. The vulnerability allows authenticated users with Seller-level access or above to upload arbitrary files through the template-submit-listing.php file. The flaw exists because the front-end listing submission feature does not validate uploaded file types, classified under [CWE-434] Unrestricted Upload of File with Dangerous Type. All versions up to and including 3.5.4 are affected. Attackers can leverage this weakness to place executable files on the web server, potentially leading to remote code execution when front-end listing submission is enabled.

Critical Impact
Authenticated attackers with Seller-level permissions can upload arbitrary files and achieve remote code execution on affected WordPress sites running Real Estate 7 versions 3.5.4 and earlier.

Affected Products

Contempo Themes Real Estate 7 WordPress theme, all versions through 3.5.4
WordPress installations with front-end listing submission enabled
Sites permitting Seller-level or higher user registration

Discovery Timeline

2025-04-01 - CVE-2025-2891 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2891

Vulnerability Analysis

The vulnerability resides in the template-submit-listing.php file, which handles front-end property listing submissions. The file accepts user-uploaded content without enforcing file type restrictions or extension allowlists. An attacker authenticated as a Seller can submit a request to the listing form with a malicious file attached. The server stores the file within the WordPress uploads directory, where it remains accessible over HTTP.

When the uploaded file is a PHP script or other executable format, the web server interprets and runs it on subsequent requests. This results in arbitrary code execution under the privileges of the PHP process. The attack requires Seller-level access, which many real estate sites grant through open registration to facilitate listing submissions.

Root Cause

The root cause is missing input validation on the file upload handler. The template-submit-listing.php script does not verify the MIME type, file extension, or magic bytes of uploaded content. There is no allowlist restricting uploads to image formats such as JPEG or PNG, which would be appropriate for property listing media.

Attack Vector

The attack vector is network-based with low complexity. An attacker registers a Seller account on a target site running Real Estate 7. The attacker then submits a listing through the front-end form, attaching a PHP payload as the listing image or attachment. The server writes the payload to a web-accessible directory. The attacker then requests the uploaded file directly, triggering server-side execution. No user interaction is required beyond the attacker's own authenticated session.

No public proof-of-concept code is currently documented in the references. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-2891

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present in the WordPress wp-content/uploads/ directory or theme-specific upload paths
POST requests to template-submit-listing.php from accounts with Seller role containing non-image MIME types
Outbound network connections originating from the PHP-FPM or Apache worker process to unfamiliar destinations
New WordPress user registrations followed shortly by listing submissions containing attachments

Detection Strategies

Scan the uploads directory for files with executable extensions and compare against the expected media file types
Review web server access logs for direct GET requests to files inside upload directories that return Content-Type: text/html or application/x-httpd-php
Inspect WordPress audit logs for Seller-role accounts that have submitted listings shortly after registration
Monitor for modifications to PHP files within the theme directory that do not correspond to a known update

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads/ and theme directories
Forward web server and WordPress activity logs to a centralized SIEM for correlation
Alert on POST requests to the listing submission endpoint with multipart/form-data payloads larger than typical image uploads
Track creation of new Seller accounts and correlate with subsequent upload activity

How to Mitigate CVE-2025-2891

Immediate Actions Required

Update the Real Estate 7 theme to a version later than 3.5.4 once a patched release is published by Contempo Themes
Disable the front-end listing submission feature until a patched version is installed
Restrict user registration to prevent unauthenticated attackers from obtaining Seller-level accounts
Audit the wp-content/uploads/ directory and remove any files with executable extensions

Patch Information

Review the Contempo Themes Changelog for the latest Real Estate 7 release notes and apply the vendor-provided update that addresses CVE-2025-2891. After patching, rotate WordPress administrator credentials and review all user accounts created during the exposure window.

Workarounds

Configure the web server to deny PHP execution within the WordPress uploads directory using .htaccess rules or equivalent Nginx location blocks
Deploy a Web Application Firewall rule that blocks uploads of files with PHP-related extensions to the listing submission endpoint
Require administrator approval before activating new Seller accounts
Remove the front-end listing submission template until the patched theme version is deployed

bash

# Apache: deny PHP execution in WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>