CVE-2024-13421 is a critical privilege escalation vulnerability in the Real Estate 7 WordPress theme by contempoinc, affecting all versions up to and including 3.5.1. The vulnerability arises because the theme does not properly restrict which user roles can be selected during registration, enabling unauthenticated attackers to create administrative accounts. This results in complete compromise potential of affected WordPress sites. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently documented.

Successful exploitation allows unauthenticated attackers to create new administrative user accounts on affected WordPress sites, leading to full site compromise. This includes unauthorized access to all administrative functions, data exposure, modification, and potential site disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict user registration functionality or implement additional access controls to prevent unauthorized account creation with elevated privileges.