CVE-2025-6190: WordPress Realty Portal Privilege Escalation

CVE-2025-6190 Overview

CVE-2025-6190 is a privilege escalation vulnerability in the Realty Portal – Agent plugin for WordPress, affecting versions 0.1.0 through 0.3.9. The flaw resides in the rp_user_profile() AJAX handler, which reads user-supplied meta key/value pairs from $_POST and passes them directly to update_user_meta(). Because the handler enforces no whitelist or capability check, any authenticated user with Subscriber-level access or higher can overwrite the wp_capabilities meta and grant themselves the administrator role. The vulnerability is tracked under [CWE-862] Missing Authorization.

Critical Impact

Authenticated Subscriber accounts can escalate to full administrator privileges, allowing complete takeover of the WordPress site.

Affected Products

• Realty Portal – Agent plugin for WordPress, versions 0.1.0 through 0.3.9
• WordPress installations exposing the rp_user_profile AJAX action
• Any site permitting user registration at Subscriber level with this plugin active

Discovery Timeline

• 2025-07-23 - CVE-2025-6190 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6190

Vulnerability Analysis

The vulnerability sits in the rp_user_profile() function in includes/class-agent-process.php. The handler is registered as an AJAX endpoint and is reachable by any authenticated user. It accepts arbitrary key/value pairs in the POST body and applies them as user meta without filtering. The handler trusts client input to identify which meta fields to update, including security-sensitive fields managed by WordPress core.

WordPress stores role assignments in the wp_capabilities user meta. By submitting that key with a serialized payload assigning administrator => true, an attacker rewrites their own role record. The lack of a capability check (current_user_can()) and absence of a key whitelist combine to make this a single-request takeover. The exploit requires only valid session credentials and a CSRF nonce obtainable from the standard plugin interface.

Root Cause

The root cause is missing authorization combined with unsanitized passthrough to update_user_meta(). The handler does not restrict callers by role and does not constrain the meta key namespace, so privileged keys reserved by WordPress core become writable by low-privileged sessions.

Attack Vector

The attack is remote and network-based. An attacker registers or compromises a Subscriber account, retrieves the AJAX nonce from a page that renders the agent profile form, and issues a POST request to admin-ajax.php with action=rp_user_profile and a meta[wp_capabilities] payload. The server overwrites the role meta, and the next authenticated request executes with administrator privileges.

No exploitation code example is reproduced here. See the Wordfence Vulnerability Report and the WordPress Realty Portal Agent Code for the vulnerable handler.

Detection Methods for CVE-2025-6190

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=rp_user_profile with a meta[wp_capabilities] parameter
• Subscriber or Contributor accounts whose wp_capabilities meta unexpectedly contains administrator
• New administrator users created shortly after self-registration events
• Audit log entries showing role changes initiated by non-administrator sessions

Detection Strategies

• Inspect web server access logs for rp_user_profile AJAX calls from accounts that should not modify privileged meta
• Compare current user roles against a baseline export of wp_usermeta rows where meta_key='wp_capabilities'
• Alert on any HTTP body containing the substring wp_capabilities posted to admin-ajax.php

Monitoring Recommendations

• Forward WordPress audit and access logs to a centralized log store for retention and correlation
• Monitor for sudden growth in administrator-role accounts on sites running the Realty Portal – Agent plugin
• Track plugin inventory and flag any host still running Realty Portal – Agent at version 0.3.9 or earlier

How to Mitigate CVE-2025-6190

Immediate Actions Required

• Disable or uninstall the Realty Portal – Agent plugin until a patched release is installed
• Audit all WordPress accounts and remove unauthorized administrators
• Force password resets and invalidate active sessions for all users with elevated roles
• Disable open user registration on affected sites if it is not strictly required

Patch Information

No fixed version is identified in the available references at the time of writing. Track the plugin status on the WordPress Realty Portal Agent Plugin page and the Wordfence Vulnerability Report for updates. Until a patched build is published, removal is the recommended remediation.

Workarounds

• Block POST requests to admin-ajax.php containing action=rp_user_profile at the WAF or reverse proxy layer
• Restrict the rp_user_profile AJAX endpoint to administrator sessions using a must-use plugin that calls remove_action() on the unauthenticated hook
• Set define('DISALLOW_FILE_MODS', true) and limit user registration to trusted roles

# Example WAF rule (ModSecurity) to block exploitation attempts
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1006190,phase:2,deny,status:403,log,msg:'Block CVE-2025-6190 rp_user_profile abuse'"
  SecRule ARGS:action "@streq rp_user_profile" \
    "chain"
    SecRule ARGS_NAMES "@rx wp_capabilities|role" "t:lowercase"