The Real Spaces WordPress Properties Directory Theme (versions up to 3.6) contains an improper privilege management vulnerability (CWE-269) in the 'imic_agent_register' function. This flaw permits unauthenticated attackers to specify their user role during registration without restriction, enabling them to escalate privileges to Administrator. The vulnerability is remotely exploitable without user interaction and has a critical CVSS 3.1 base score of 9.8, reflecting its severe impact on system confidentiality, integrity, and availability. No patch or official fix has been published by the vendor as of the information provided.

Successful exploitation allows unauthenticated attackers to gain administrative privileges on affected WordPress sites using the Real Spaces theme, potentially leading to full site compromise including data theft, modification, or deletion, and disruption of service. The vulnerability affects all versions up to 3.6 of the theme. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict user registration functionality in the theme or WordPress site to prevent unauthorized role assignment. Monitor vendor channels for updates and apply patches promptly once released.