The RH – Real Estate WordPress Theme is vulnerable to a privilege escalation flaw that allows authenticated users with subscriber-level access and higher to elevate their own role to administrator by abusing the inspiry_update_profile() function. The issue occurs because the theme fails to restrict which user roles can be updated, enabling a user to set their role to administrator. This flaw is classified as CWE‑269 and can compromise confidentiality, integrity, and availability of the WordPress site if an attacker gains administrator privileges. A partial fix was included in version 4.4.0, but the vulnerability is fully addressed only in 4.4.1.

The affected product is RH – Real Estate WordPress Theme by InspiryThemes. All releases up to and including version 4.4.0 are impacted. Versions 4.4.1 and newer contain a full patch that removes the ability for non-admin users to change roles through the profile update function.

The vulnerability carries a CVSS score of 8.8, indicating a high severity. The EPSS score is less than 1%, suggesting a low probability of real‑world exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is the theme’s profile update endpoint that is accessible to any logged‑in user; an attacker needs only authenticate at subscriber level or higher to manipulate their own role. While no confirmed exploits exist, the high impact of achieving administrator rights warrants immediate attention.