CVE-2025-1515

—

CVSS 3.1

9.8 critical

EPSS

<1%p44

Published

Mar 5, 2025 (Mar 5, 2025)

Modified

Jun 17, 2026

Description

The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.

Ecosystems: WordPress
Weakness: CWE-288
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.