CVE-2025-2891 is a vulnerability in the Real Estate 7 WordPress theme (versions up to 3.5.4) caused by insufficient validation of uploaded files in the 'template-submit-listing.php' script. Authenticated users with Seller-level privileges or higher can exploit this to upload arbitrary files, potentially enabling remote code execution if the front-end listing submission feature is active. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a high CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows authenticated users with Seller-level access or above to upload arbitrary files to the server hosting the Real Estate 7 WordPress theme. This can lead to remote code execution if the front-end listing submission functionality is enabled, potentially compromising the affected website's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling front-end listing submission functionality if feasible and restrict Seller-level access to trusted users only. Monitor vendor channels for updates and apply any official patches promptly once released.