Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-7718: Resideo Plugin for WordPress Allows Attacker to Take Over Any Account

CVE-2025-7718 · published 1 year ago

Summary

The Resideo Plugin for WordPress has a security flaw that allows an attacker with a Subscriber-level account or higher to take control of any user account, including administrator accounts, by changing their email address and resetting their password. This is a risk because an attacker could then access sensitive data or make changes to the website. Update the Resideo Plugin to version 2.5.5 or later to fix the issue.

Original advisory text

The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published10 Sep 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-7718 · NVD

Track software like this

Free during beta