CVE-2025-48150

The vulnerability is a missing authorization check in the WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin (real-estate-right-now). Versions up to and including 4.48 lack proper access control security level validation in certain functions, allowing unprivileged users to perform actions intended for higher-privileged roles [1].

Exploitation does not require authentication; an attacker can trigger the vulnerable functionality without a valid user session or nonce token check. The plugin fails to enforce proper capability checks, which is a classic broken access control issue [1].

A successful attack enables an unprivileged actor to execute privileged actions—such as modifying plugin settings or creating custom fields—without authorization, potentially leading to further site compromise [1].

The vendor has released version 4.49 which resolves the vulnerability. Users are strongly advised to update immediately or enable auto-updates via Patchstack. While the CVSS score is low (4.3), the vulnerability may be targeted in mass-exploit campaigns [1].