The vulnerability is a missing authorization flaw in the sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin that allows an attacker to bypass the plugin’s intended access control levels, potentially enabling unauthorized use of plugin features and exposure or alteration of application data. The CVE description does not enumerate specific data or functions at risk.

Vendors or site owners using any version of the sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin up to and including 4.48 on a WordPress installation are affected. The issue applies to all installed copies of the plugin, regardless of user role, if access control is misconfigured.

With a CVSS score of 4.3 the vulnerability is in the low‑to‑moderate severity range. An EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The flaw is not listed in CISA’s KEV catalog. The description does not specify an exact attack vector, but it can be inferred that an attacker could target the plugin via the WordPress web interface over HTTP/HTTPS by sending crafted requests to the plugin’s endpoints, without needing additional system privileges.