CVE-2026-15142: Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allowattachmentactions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
Affected Software
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-15142?
The risk level of CVE-2026-15142 is assessed as high with a score of 7.5.
How does CVE-2026-15142 enable privilege escalation?
CVE-2026-15142 allows privilege escalation due to improper capability handling in the allow_attachment_actions() function.
What versions of Real Estate Manager Pro are affected by CVE-2026-15142?
CVE-2026-15142 affects all versions of Real Estate Manager Pro up to and including 12.8.6.
What types of capabilities are impacted by CVE-2026-15142?
CVE-2026-15142 impacts user capabilities by incorrectly treating user IDs as media attachment IDs.
How can I mitigate the risk of CVE-2026-15142?
To mitigate the risk of CVE-2026-15142, update the Real Estate Manager Pro plugin to a version higher than 12.8.6.