CVE-2025-3609: Reales WP STPT Auth Bypass Vulnerability

CVE-2025-3609 Overview

The Reales WP STPT plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to register new user accounts. The vulnerability affects all versions up to and including 2.1.2. The root issue lies in the reales_user_signup_form AJAX action, which fails to check whether user registration is enabled before creating an account. Attackers can bypass site administrator settings that explicitly disable registration. This weakness is classified under [CWE-863: Incorrect Authorization]. Chained with other flaws, the created account can be leveraged for privilege escalation on the affected WordPress site.

Critical Impact
Unauthenticated attackers can create WordPress user accounts on sites where registration is disabled, enabling follow-on privilege escalation attacks.

Affected Products

Reales WP STPT plugin for WordPress, versions through 2.1.2
WordPress sites using the Reales WP Real Estate theme distribution containing the plugin
Deployments with user registration disabled at the site level

Discovery Timeline

2025-05-06 - CVE-2025-3609 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3609

Vulnerability Analysis

The Reales WP STPT plugin exposes an AJAX endpoint named reales_user_signup_form that processes user registration requests. The endpoint accepts registration submissions from any unauthenticated visitor. WordPress site administrators typically control account creation through the users_can_register option in the general settings. The vulnerable handler does not consult this setting before invoking the registration logic. As a result, the plugin creates accounts even when the site has registration disabled. This creates a persistent foothold that attackers can chain with additional flaws to gain elevated privileges on the WordPress instance.

Root Cause

The underlying defect is a missing authorization check in the AJAX registration handler. The plugin should read the users_can_register option and reject registration attempts when it evaluates to false. Instead, the handler proceeds directly to account creation logic without verifying the site-level policy. This is a classic incorrect authorization weakness where a security decision relies on client-side or unrelated checks rather than the actual policy toggle.

Attack Vector

The attack is remote and requires no authentication or user interaction. An attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint with the action parameter set to reales_user_signup_form and supplies the required registration fields. The server processes the request and creates a new subscriber-level account regardless of the site's registration configuration. Attackers can automate account creation and then combine the newly minted credentials with other privilege escalation vulnerabilities to compromise the site further.

No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-3609

Indicators of Compromise

Unexpected new user accounts in wp_users on WordPress sites running the Reales WP STPT plugin
HTTP POST requests to /wp-admin/admin-ajax.php containing the parameter action=reales_user_signup_form
Account creation events occurring on sites where the general setting "Anyone can register" is disabled

Detection Strategies

Monitor web server access logs for POST requests to admin-ajax.php referencing the reales_user_signup_form action from unauthenticated sessions
Alert when new WordPress users are created outside of administrator-driven workflows
Correlate new user registrations with the current value of the users_can_register option to surface policy violations

Monitoring Recommendations

Enable WordPress audit logging for user creation, role changes, and option modifications
Ingest WordPress application and access logs into a centralized platform for retention and querying
Baseline registration volume and rate-limit requests to admin-ajax.php to detect enumeration or bulk account creation

How to Mitigate CVE-2025-3609

Immediate Actions Required

Update the Reales WP STPT plugin to a version later than 2.1.2 once the vendor releases a fix
Audit the wp_users table for accounts created after the plugin was installed and remove unauthorized entries
Restrict access to admin-ajax.php for the reales_user_signup_form action at the web application firewall layer

Patch Information

At the time of publication, no fixed version was identified in the enriched data. Site owners should consult the ThemeForest Product Page and the Wordfence Vulnerability Report for updated patch availability.

Workarounds

Disable or remove the Reales WP STPT plugin until a patched version is available
Deploy a web application firewall rule that blocks POST requests to admin-ajax.php where action=reales_user_signup_form
Enforce CAPTCHA and rate limiting on registration endpoints to slow automated abuse

bash

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1003609,msg:'Block Reales WP STPT unauthorized registration CVE-2025-3609'"
  SecRule ARGS:action "@streq reales_user_signup_form" "t:lowercase"