The Real Spaces WordPress Properties Directory Theme enables a user to change their role via the 'change_role_member' parameter, but the theme lacks any restriction on role assignment. As a result, an attacker who can trigger a profile update can set the role to Administrator, effectively bypassing all security controls and gaining full control over the site. This is a classic privilege escalation flaw, classified as CWE‑269.

The vulnerability exists in all releases of the Real Spaces WordPress Properties Directory Theme up to and including version 3.5. The theme is distributed by imithemes and is installed as a WordPress plugin or theme package under the path Real Spaces. Any WordPress deployment that uses these versions is potentially affected.

The CVSS score of 8.8 reflects a high severity exploitation risk, while the EPSS score of less than 1% indicates that commercial exploit tools are currently not widely spread. The flaw does not appear in CISA’s KEV catalog. Attackers can exploit the issue without prior authentication, simply by sending a crafted request that includes the 'change_role_member' parameter. Once the role is escalated to Administrator, the attacker can modify site content, install additional malicious plugins, and manipulate sensitive data. Given the low EPSS but high CVSS, precautionary patching is strongly recommended.