Cyber Resilience

CVE-2025-8218

High

Published: 19 August 2025

Published
19 August 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8218 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-8218 is a privilege escalation vulnerability in the Real Spaces - WordPress Properties Directory Theme for WordPress, affecting all versions up to and including 3.5. The flaw arises from a lack of restrictions on the 'change_role_member' parameter during profile updates, enabling attackers to arbitrarily select their user role. Published on 2025-08-19, it is associated with CWE-269 (Improper Privilege Management) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability by manipulating the 'change_role_member' parameter during a profile update to escalate their privileges to any role, including Administrator. This grants full control over the affected WordPress site, allowing actions such as modifying content, installing plugins, or accessing sensitive data, with network accessibility and no user interaction required beyond low initial privileges per the CVSS vector.

Mitigation details are outlined in advisories referenced by the CVE, including Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07880b-9af1-4b1e-aa70-b95ef10a6e33?source=cve and the theme's page on ThemeForest at https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779. Security practitioners should consult these sources for patch availability or workaround guidance specific to the theme.

EU & UK References

Vulnerability details

The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update…

more

role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct privilege escalation via improper role assignment in public-facing web app (WordPress), matching Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-44250Shared CWE-269
CVE-2024-53706Shared CWE-269
CVE-2025-66374Shared CWE-269
CVE-2026-28995Shared CWE-269
CVE-2025-43199Shared CWE-269
CVE-2025-36640Shared CWE-269
CVE-2025-8899Shared CWE-269
CVE-2024-47770Shared CWE-269
CVE-2025-24254Shared CWE-269
CVE-2025-27639Shared CWE-269

Affected Assets

Themeforest
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires enforcement of approved authorizations during profile updates, directly preventing unauthorized privilege escalation via the unrestricted 'change_role_member' parameter.

prevent

Restricts user privileges to the minimum necessary, mitigating the ability of attackers to escalate to Administrator role through arbitrary role selection.

prevent

Establishes processes for managing account roles and privileges, ensuring restrictions on modifications like those exploited in the profile update vulnerability.

References