Description
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
Published: 2025-03-05
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass / Account Takeover
Action: Immediate Patch
AI Analysis

Impact

The WP Real Estate Manager plugin suffers an authentication bypass due to insufficient identity verification on the LinkedIn login request process. This flaw enables attackers who are not authenticated to act as any user on the site, including administrators. Consequently, an attacker could gain full control over the WordPress site, modify listings, change settings, or extract sensitive data.

Affected Systems

All versions of the Chimpstudio WP Real Estate Manager plugin up to and including 2.8 are affected. The vulnerability applies to any WordPress installation that has the plugin installed and the LinkedIn login feature enabled.

Risk and Exploitability

The flaw carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting that, while high impact, the likelihood of exploitation is currently low to moderate. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to exploit the LinkedIn authentication flow, which is possible when the plugin's LinkedIn integration is active; the flaw does not require additional access permissions.

Generated by OpenCVE AI on April 21, 2026 at 22:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WP Real Estate Manager to the latest version that addresses the authentication bypass.
  • Disable or restrict the LinkedIn login integration if it is not required, to eliminate the exploitation path.
  • Review administrator accounts and enforce additional authentication controls, such as two‑factor authentication, to prevent unauthorized access.

Generated by OpenCVE AI on April 21, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-6025 The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
History

Wed, 05 Mar 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 05 Mar 2025 09:30:00 +0000

Type Values Removed Values Added
Description The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
Title WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:04:30.392Z

Reserved: 2025-02-20T19:58:26.650Z

Link: CVE-2025-1515

cve-icon Vulnrichment

Updated: 2025-03-05T14:21:06.245Z

cve-icon NVD

Status : Deferred

Published: 2025-03-05T10:15:19.850

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-1515

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T22:15:45Z

Weaknesses