CVE-2025-6934

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

• CWE-269

• https://plugins.trac.wordpress.org/browser/opal-estate-pro/trunk/inc/user/class-opalestate-user.php#L228
• https://plugins.trac.wordpress.org/browser/opal-estate-pro/trunk/inc/user/class-opalestate-user.php#L235
• https://themeforest.net/item/fullhouse-real-estate-responsive-wordpress-theme/16179481
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7b75a4-67b4-4347-91a6-dbf98da5ceaf?source=cve

Published

Jul 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69334Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-69335Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-69336Missing Authorization vulnerability in bdthemes Ultimate Sto…4.3
• CVE-2025-69337Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2025-69338Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2025-69339Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-69340Missing Authorization vulnerability in BuddhaThemes WeDesign…7.5
• CVE-2025-69341Missing Authorization vulnerability in BuddhaThemes WeDesign…5.4
• CVE-2025-69342Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-69343Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-69344Missing Authorization vulnerability in themehunk Oneline Lit…4.3
• CVE-2025-69345Missing Authorization vulnerability in BoldGrid Post and Pag…4.3