The Realty Portal – Agent plugin for WordPress contains a missing authorization check in the rp_user_profile() AJAX handler for versions 0.1.0 through 0.3.9. The handler accepts client‑supplied meta key/value pairs from $_POST and passes them directly to update_user_meta() without restricting to a safe whitelist. This allows any authenticated user with Subscriber-level access or higher to overwrite the wp_capabilities meta field and grant themselves the administrator role, effectively taking full control of the site.

This issue affects the Realty Portal – Agent plugin, published by Nootheme, in WordPress installations that use plugin versions 0.1.0 to 0.3.9. Users of later releases are not impacted unless the vulnerability has been reintroduced.

The flaw carries a CVSS score of 8.8, indicating a high‑severity issue. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated but only at the Subscriber level, which many websites grant to regular users. Once authenticated, the attacker can trigger the AJAX request to elevate privileges to administrator, leading to full control over the site, potential data exfiltration, and modification of site settings.