{"id":4221,"date":"2026-01-23T00:36:39","date_gmt":"2026-01-23T00:36:39","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2026\/01\/23\/realhomes-crm-plugin-flaw-affected-30000-wordpress-sites\/"},"modified":"2026-01-23T00:36:39","modified_gmt":"2026-01-23T00:36:39","slug":"realhomes-crm-plugin-flaw-affected-30000-wordpress-sites","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2026\/01\/23\/realhomes-crm-plugin-flaw-affected-30000-wordpress-sites\/","title":{"rendered":"RealHomes CRM Plugin Flaw Affected 30,000 WordPress Sites"},"content":{"rendered":"
\n

A security flaw in the RealHomes CRM plugin, bundled with a WordPress theme installed on more than 30,000 websites, has been patched after researchers found it could allow low-privileged users to upload malicious files and take control of affected sites.<\/p>\n

The vulnerability affected RealHomes CRM versions 1.0.0 and earlier and allowed any logged-in user with Subscriber-level access or higher to upload arbitrary files through a CSV import feature. If exploited, the issue could be used to place malicious code on the server and ultimately lead to a full site takeover.<\/p>\n

RealHomes CRM is included with the RealHomes WordPress theme, developed by InspiryThemes. The theme is widely used to build real estate websites . It offers tools such as advanced property search, multiple listing layouts, front-end submission and management, payment integration via PayPal and Stripe and support for page builders including Elementor.\u00a0<\/p>\n

The flaw has been assigned CVE-2025-67968 and was discovered and reported by Patchstack Alliance community member wackydawg. It was located in an AJAX function responsible for handling CSV file uploads.<\/p>\n

Although the function used a nonce for request validation, that nonce could be retrieved by Subscriber users from both admin and front-end pages.<\/p>\n

Read more on WordPress plugin security: Critical WordPress Plugin Bugs Exploited En Masse<\/em><\/p>\n

Why the Upload Mechanism Was Risky<\/strong><\/h2>\n

Further analysis showed that the upload process lacked several basic security controls. In particular, there was no check to confirm whether a user had sufficient privileges to perform the action, and no validation of file types or extensions before files were written to the server.<\/p>\n

Key issues included:<\/p>\n