CVE-2025-6190 is a privilege escalation vulnerability in the Realty Portal – Agent WordPress plugin caused by missing authorization in the rp_user_profile() AJAX handler. The handler reads meta key-value pairs from user input and updates user metadata without restricting which keys can be modified. This allows authenticated users with low privileges to escalate their permissions by modifying the wp_capabilities meta key, thereby gaining administrator rights. The vulnerability affects versions 0.1.0 through 0.3.9 of the plugin. It has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Subscriber-level access or higher can exploit this vulnerability to escalate their privileges to administrator by modifying the wp_capabilities user meta. This grants full control over the WordPress site, including the ability to install plugins, modify content, and manage users. The impact includes complete compromise of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's AJAX handlers to trusted users only and consider disabling or removing the Realty Portal – Agent plugin if not essential. Monitor for updates from the vendor and apply patches promptly once released.