CVE-2024-13307: Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates
First published: Thu Apr 24 2025(Updated: )
The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Reales WP Real Estate WordPress Theme | <=2.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13307?
CVE-2024-13307 is classified as a high severity vulnerability due to the risk of unauthorized file modification and data loss.
How do I fix CVE-2024-13307?
To fix CVE-2024-13307, ensure that capability checks are implemented in the affected functions of the Reales WP Real Estate WordPress Theme.
Which versions of Reales WP Real Estate WordPress Theme are affected by CVE-2024-13307?
CVE-2024-13307 affects Reales WP Real Estate WordPress Theme versions up to and including 2.1.2.
What actions can be taken to mitigate CVE-2024-13307?
To mitigate CVE-2024-13307, restrict theme access and monitor file modification activities on your WordPress site.
Is CVE-2024-13307 related to unauthenticated access?
Yes, CVE-2024-13307 involves unauthorized access that could lead to data loss due to insufficient capability checks.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/reales wp
- canonical/reales wp real estate wordpress theme