The vulnerability CVE-2025-68071 affects the Essential Real Estate plugin by g5theme, allowing authorization bypass through a user-controlled key due to misconfigured access control. This flaw enables an attacker with some privileges to access resources or functions they should not be authorized to use. The issue affects versions up to and including 5.3.2. The CVSS 3.1 base score is 6.5, reflecting a network attack vector, low complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality only. No patch or vendor advisory is currently provided.

An attacker with limited privileges can bypass authorization controls, potentially gaining unauthorized access to sensitive information within the Essential Real Estate plugin. The confidentiality of data is at risk, but integrity and availability are not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from g5theme and apply patches promptly once available. Review and tighten access control configurations where possible to reduce exposure.