CVE-2021-24238CWE-284

CVE-2021-24238: vulnerability in PureThemes Realteo

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

Published · Updated

Follow this CVE+ Monitor Realteo+ Monitor Findeo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.1%
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.
Affected products
PureThemes · FindeoPureThemes · Realteo
Related CVEs — PureThemes Realteo

In the same product, most dangerous first.

CVE-2021-24237—Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 6.3%CVE-2025-2232CRITICALRealteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'EPSS 0.6%