CVE-2025-1285: Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update
The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the deleteapikey and saveapikey AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to internal services and update API key details.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1285?
CVE-2025-1285 has a medium severity rating due to unauthorized access potential.
How do I fix CVE-2025-1285?
To fix CVE-2025-1285, update the Resido Real Estate WordPress Theme to version 3.7 or later.
What impact does CVE-2025-1285 have on my site?
CVE-2025-1285 can allow unauthenticated attackers to delete or save API keys, compromising your website's security.
Which versions of the Resido Real Estate WordPress Theme are affected by CVE-2025-1285?
CVE-2025-1285 affects all versions of the Resido Real Estate WordPress Theme up to and including version 3.6.
Is user authentication sufficient to protect against CVE-2025-1285?
No, CVE-2025-1285 exploits a lack of capability checks, allowing unauthorized access even without user authentication.