The Realteo plugin for WordPress allows any unauthenticated user to register an account with Administrator privileges because the do_register_user function does not restrict role assignment. The vulnerability is a classic authentication bypass that gives a malicious actor full site control, including content creation, user management, and potential data exfiltration. The weakness is categorized as CWE‑269: Improper Restriction of Excessive Privileges.

Users of the PureThemes Realteo plugin, version 1.2.8 or earlier, on WordPress installations that employ the Findeo theme, are susceptible. The plugin’s role handling flaw exists across all affected releases, with no service or environment constraints documented.

The CVSS score of 9.8 classifies this as a critical flaw, and although the EPSS score is currently below 1 %, the vulnerability remains exploitable because the attack requires only a web request to the public registration endpoint and no authentication credentials. The lack of CISA KEV listing does not diminish the potential impact; any site using a vulnerable plugin version can be compromised at any time.