CVE-2025-7718 Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover

🗓️ 10 Sep 2025 12:25:30Reported by WordfenceType

Subscribers can escalate to admin by changing emails via insecure object reference in Resideo plugin up to version 2.5.4.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-7718	10 Sep 202514:34	–	circl
CNNVD	WordPress plugin Resideo Plugin for Resideo - Real Estate WordPress Theme Security Vulnerability	10 Sep 202500:00	–	cnnvd
CVE	CVE-2025-7718	10 Sep 202512:25	–	cve
EUVD	EUVD-2025-27545	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7718	10 Sep 202513:15	–	nvd
Patchstack	WordPress Resideo Plugin for Resideo - Real Estate WordPress Theme plugin <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover vulnerability	9 Sep 202523:24	–	patchstack
Positive Technologies	PT-2025-37042	10 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-7718	12 Sep 202513:20	–	redhatcve
Vulnrichment	CVE-2025-7718 Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover	10 Sep 202512:25	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (September 8, 2025 to September 14, 2025)	18 Sep 202514:42	–	wordfence

[
  {
    "vendor": "pixel_prime",
    "product": "Resideo Plugin for Resideo - Real Estate WordPress Theme",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f8375ecf-e64b-4649-9341-fa45bf5556c3
themeforest	www.themeforest.net/item/resideo-real-estate-wordpress-theme/27791406

08 Apr 2026 17:33Current

CVSS 3.18.8

EPSS0.00083

CWE-639