CVE-2026-15142

CVE-2026-15142 is a privilege escalation in the Real Estate Manager Pro WordPress plugin (versions up to 12.8.6). The vulnerability lives in a function called `allow_attachment_actions()`, which accepts a user ID parameter but internally treats it as a media attachment ID. When a subscriber's user ID happens to match an existing attachment's ID, the function grants the subscriber permission to perform attachment actions they shouldn't have—viewing, editing, or deleting media they don't own. The exploitation condition is more achievable than it first appears. In typical WordPress installations, media uploads begin immediately upon plugin activation, while user registrations follow. This means subscriber IDs often align sequentially with early attachment IDs by default. You don't need unusual configuration—the default state of an established site is often exploitable. Check your installations: identify the plugin version (Real Estate Manager Pro), verify it matches the affected range, and plan to upgrade to 12.8.6 or later. Beyond patching, audit your codebase for other functions that accept ID parameters without explicit type validation—functions handling media, documents, or any object type where a user ID could be mistakenly passed as a resource ID. The pattern here is ID-type conflation: functions designed for one domain object accepting parameters intended for another, then relying on numeric coincidence to differentiate them. This isn't an edge case. It's a structural failure where attachment-handling logic gatekeeps user permissions—a violation of least surprise that guarantees maintenance confusion. The commercial 'Pro' tier designation does not imply architectural review; treat any plugin tier as potentially harboring similar patterns until proven otherwise.

Reviewed through automated stages and approved by a human before publication.