CVE-2026-15142 is a privilege escalation vulnerability in the Real Estate Manager Pro WordPress plugin affecting all versions up to and including 12.8.6. The vulnerability is due to improper capability checks in the allow_attachment_actions() function, where a target user ID can be misinterpreted as a media attachment ID during permission validation. This allows an authenticated attacker with Subscriber-level access or above to edit administrator accounts and escalate their privileges to Administrator if the targeted user ID matches an existing media attachment ID.

An attacker with authenticated access at Subscriber level or higher can escalate their privileges to Administrator, gaining full control over the WordPress site. This includes the ability to modify site content, settings, and potentially install malicious code or plugins, leading to a complete compromise of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict user roles to trusted users only and monitor for suspicious privilege changes. Avoid granting Subscriber-level access to untrusted users.