CVE-2025-3610 Overview
CVE-2025-3610 is a privilege escalation vulnerability in the Reales WP STPT plugin for WordPress. The flaw affects all plugin versions up to and including 2.1.2. The plugin fails to validate a user's identity before updating account details such as passwords and email addresses. Authenticated attackers with subscriber-level access or higher can change the credentials of any user, including administrators, and take over those accounts. The weakness is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Attackers can chain CVE-2025-3610 with CVE-2025-3609 to achieve remote code execution as an originally unauthenticated user with no existing account.
Affected Products
- Reales WP STPT plugin for WordPress, versions up to and including 2.1.2
- WordPress sites bundling the Reales WP Real Estate theme with the STPT plugin
- Any deployment permitting subscriber-level registration on affected versions
Discovery Timeline
- 2025-05-06 - CVE-2025-3610 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3610
Vulnerability Analysis
The Reales WP STPT plugin exposes account update functionality that accepts a user identifier from the request without confirming that the identifier belongs to the currently authenticated session. An attacker with a subscriber account submits an update request supplying another user's ID along with a new password or email address. The plugin processes the change against the target account instead of the requester's account.
This pattern matches [CWE-639] Authorization Bypass Through User-Controlled Key, also known as Insecure Direct Object Reference (IDOR). The impact escalates when the target is an administrator, granting full control over the WordPress instance. Chaining with CVE-2025-3609 removes the authentication prerequisite entirely, enabling remote code execution paths against unauthenticated visitors.
Root Cause
The plugin's account update handler treats the submitted user ID as trusted input. It does not compare that identifier against the session owner, and it does not require re-authentication or a valid nonce tied to the target account. Sensitive fields such as user_pass and user_email are updated directly via WordPress user APIs after this missing check.
Attack Vector
Exploitation requires network access to the WordPress site and any authenticated account, which is typically obtained through open registration. The attacker sends a crafted POST request to the vulnerable plugin endpoint containing the victim's user ID and new credentials. Because no user interaction is required from the victim, the takeover completes silently. After the password change, the attacker logs in as the administrator and installs plugins, uploads themes, or executes arbitrary PHP through standard administrative features.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for additional technical detail.
Detection Methods for CVE-2025-3610
Indicators of Compromise
- Unexpected password or email changes on administrator accounts recorded in the WordPress wp_users and wp_usermeta tables.
- New administrator accounts created shortly after subscriber-level registrations from unfamiliar IP addresses.
- POST requests to Reales WP STPT plugin endpoints containing user_id parameters that do not match the authenticated session's user.
Detection Strategies
- Enable WordPress audit logging for user profile updates and correlate the acting session user against the modified ID field.
- Alert on any account update where the session cookie user differs from the target user unless the actor holds the edit_users capability.
- Review web server logs for repeated requests to Reales WP STPT AJAX or REST endpoints originating from low-privilege sessions.
Monitoring Recommendations
- Monitor administrator login events for source IP or user-agent changes following any subscriber account activity.
- Track plugin, theme, and file editor usage in wp-admin for changes that follow a password reset event.
- Ingest WordPress and web server logs into a centralized platform to retain evidence of the exploitation chain with CVE-2025-3609.
How to Mitigate CVE-2025-3610
Immediate Actions Required
- Update the Reales WP STPT plugin to a version released after 2.1.2 that addresses the missing authorization check.
- Force a password reset for every WordPress account, prioritizing administrators, editors, and shop managers.
- Disable open user registration on the site until the plugin is patched and audit trails have been reviewed.
- Revoke and reissue any active WordPress authentication cookies by rotating the AUTH_KEY and related salts in wp-config.php.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Site owners should consult the plugin vendor via the ThemeForest Real Estate Theme listing and the Wordfence Vulnerability Analysis for updated fix guidance.
Workarounds
- Deactivate the Reales WP STPT plugin until a patched build is available and installed.
- Restrict access to the plugin's account update endpoints at the web application firewall by blocking requests where the submitted user_id differs from the session owner.
- Limit new registrations to email-verified users and remove the subscriber role's ability to reach front-end account management pages.
- Apply the principle of least privilege by removing unused administrator accounts and enforcing multi-factor authentication for remaining privileged users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
