The theme contains a functionality called 'imic_agent_register' that allows user registration. The function fails to enforce role validation, permitting any role value to be accepted. An attacker can set the role to Administrator, yielding full administrative control over the WordPress site, including configuration changes, content creation, plugin installation, and access to all sensitive data. This weakness is an example of Improper Privilege Escalation (CWE-269).

All released versions of Real Spaces – WordPress Properties Directory Theme by imithemes up to and including 3.6 are vulnerable. WordPress sites that have installed this theme and expose the registration feature are at risk.

With a CVSS score of 9.8, the vulnerability is classified as very high severity. The EPSS score of less than 1% indicates that exploit attempts are currently rare and the theme is not listed in CISA KEV. The attack vector is unauthenticated remote; a malicious actor merely needs to submit a crafted request to the registration endpoint, specifying the Administrator role, to gain administrative privileges. No credentials or additional privileges are required, making the exploitation path highly accessible to threat actors.