Executive brief
RealHomes, a popular WordPress theme for real estate websites, contains a security flaw that allows users with basic 'Subscriber' accounts to inject malicious code. If exploited, an attacker could potentially take control of the website, access sensitive data, or disrupt services. This vulnerability is considered high risk because it can be used in automated attacks against many websites simultaneously.
Technical details
A PHP Object Injection vulnerability exists in the RealHomes theme for WordPress (versions <= 4.5.3) due to improper deserialization of user-supplied data (CWE-502). An attacker with Subscriber-level privileges can send specially crafted input to the application, which, if a suitable Property Oriented Programming (POP) chain is present in the environment, could lead to remote code execution, SQL injection, or file system manipulation. The vulnerability is reachable over the network without user interaction, though it requires basic authentication. The issue is resolved in version 4.5.4.
Affected products
- InspiryThemes RealHomes <= 4.5.3
Timeline
- 2026-06-16: other: Reported by researcher daroo
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: disclosed: CVE published to NVD
- 2026-06-26: patched: Version 4.5.4 released to address the vulnerability