Every CVE Search/ Get API key

CVE-2025-6934

Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'

9.8 CriticalPublic exploit

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

25.4%Up 25.3 points since Jul 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.8

Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Record
CVE-2025-6934
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2025-19602 9.8

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Record
EUVD-2025-19602
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9w3f-cw3m-94h4 9.8

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the...

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Record
GHSA-9w3f-cw3m-94h4
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
NVD 9.8

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.

Record
CVE-2025-6934
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiThe Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
PoC in GitHub0xTerror/CVE-2025-69342026-03-13
PoC in GitHub0xgh057r3c0n/CVE-2025-69342025-08-16
PoC in GitHub1atakan1/CVE-2025-69342026-01-30
PoC in GitHubAnotherSec/CVE-2025-69342025-09-02
PoC in GitHubJenderal92/WP-CVE-2025-69342025-10-05
PoC in GitHubMejbanKadir/CVE-2025-6934-PoC2026-03-20
PoC in GitHubMrjHaxcore/CVE-2025-69342025-07-02
PoC in GitHubNxploited/CVE-2025-69342025-07-01
PoC in GitHubryhnmhrdka/CVE-2025-69342025-09-08
PoC in GitHubyukinime/CVE-2025-69342025-08-27

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-6934 is a critical vulnerability (CVSS 9.8) in Wpopal Opal Estate Pro – Property Management And Submission, published July 1, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.4%, the 97th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open