The Placester Real Estate Website Builder plugin for WordPress versions up to 1.4.3 permits any user to invoke an AJAX action that changes a user’s email address without performing any capability, nonce, or ownership validation. This flaw allows an attacker who has no credentials to overwrite any user’s email, including that of administrators, and subsequently recover the account through the normal password‑reset mechanism. The primary impact is that an attacker can gain full control of existing accounts without authentication, leading to potential data theft, site defacement, or further zero‑day exploitation. The vulnerability represents an improper access control flaw, allowing privilege escalation from no access to privileged user actions.

The affected system is the Placester Real Estate Website Builder WordPress plugin, specifically versions 1.4.3 and earlier. Any WordPress site that has installed this plugin without updating is vulnerable. The exact product name is Placester Real Estate Website Builder plugin; vendor is identified as Unknown:placester.

The bug can be exploited by sending a crafted AJAX request to the plugin’s endpoint while unauthenticated, a low barrier attack that requires only the target domain. Although the EPSS score is not available, the lack of authentication checks combined with the ability to change an administrator’s email makes exploitation likely if an adversary can perform a password reset. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet, but its high intrinsic risk warrants immediate attention.