CVE-2025-8218 Privilege escalation in Real Spaces - WordPress Properties Directory Theme
Authenticated users can escalate privileges to Administrator by manipulating the role parameter during profile updates in the Real Spaces WordPress theme.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8218?
CVE-2025-8218 is a high-severity vulnerability in imithemes Real Spaces - WordPress Properties Directory Theme, published on 19 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.
Weakness: CWE-269
Which versions are affected by CVE-2025-8218?
How do I fix CVE-2025-8218?
No fix has been published for CVE-2025-8218 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8218 being exploited?
There is no known exploitation of CVE-2025-8218 in the wild and no public exploit code.
Sources
Also known as GHSA-rcch-6gmj-jf47.