The Resideo Plugin for Resideo - Real Estate WordPress Theme contains an authorization bypass vulnerability (CWE-639) that allows privilege escalation via account takeover. Specifically, the plugin does not properly verify a user's identity before permitting updates to user details such as email addresses. Authenticated attackers with Subscriber-level privileges or above can change any user's email address, including administrators, enabling them to reset passwords and gain unauthorized access. This vulnerability affects all versions up to 2.5.4 and has a CVSS 3.1 base score of 8.8, indicating high severity.

Successful exploitation allows an authenticated low-privilege user to escalate privileges by changing the email address of any user, including administrators. This leads to account takeover through password reset functionality, resulting in full compromise of the affected accounts. The vulnerability impacts confidentiality, integrity, and availability of the system as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and monitor for suspicious account changes. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary fix.