The vulnerability exists in the Real Estate Manager Pro WordPress plugin up to version 12.8.6 and allows a malicious authenticated user with Subscriber-level access or higher to gain full Administrator privileges. By exploiting an ID collision in the allow_attachment_actions() function, the attacker can cause the plugin to interpret a target user ID as a media attachment ID during capability checks, enabling them to edit an administrator account and elevate their own permissions. The weakness is classified as CWE-269, improper authorization, which directly undermines account integrity and ownership.

This issue affects installations of the WebCodingPlace Real Estate Manager Pro plugin where the version is 12.8.6 or earlier. No other components or software are listed as impacted.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% implies a low likelihood of exploitation in the wild. As the vulnerability is not catalogued in CISA KEV, it appears no publicly known exploits have been documented. The attack requires the attacker to be authenticated with at least Subscriber-level access; therefore, compromise is limited to users who can log into the WordPress site, but once authenticated, the scale of impact grows to full system control. The exploitation path leverages normal workflow in the plugin, making it relatively easy to trigger for an authenticated user who can target an administrator account whose user ID coincides with a media attachment ID.