CVE-2025-2891
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 1, 2025
CWE ID 434
Summary
CVE-2025-2891 is a vulnerability affecting the Real Estate 7 WordPress theme, where unvalidated file types can be uploaded via the 'template-submit-listing.php' file in all versions up to 3.5.4. This issue poses a risk for authenticated attackers with Seller-level access or higher, enabling them to upload arbitrary files on the targeted site's server. In some cases, these files could potentially lead to remote code execution if front-end listing submission has been enabled.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.