The Resideo Plugin for Resideo - Real Estate WordPress Theme is vulnerable to privilege escalation via account takeover. Users with Subscriber-level access or higher can exploit a lack of identity validation when updating account details, allowing an attacker to change any user’s email address, including administrators, and then reset the account password to gain unauthorized access.

All installs of the Resideo Plugin for Resideo - Real Estate WordPress Theme version 2.5.4 and earlier are impacted.

The CVSS score of 8.8 classifies this as high severity. The EPSS score of less than 1% indicates a low probability of exploitation; however, the vulnerability is not listed in CISA KEV. An attacker must be authenticated as a Subscriber or higher, after which the exploit can be executed by editing another user’s email. Because the attack path requires legitimate access, the risk is focused on insider or compromised accounts rather than public-facing vectors.