CVE-2026-54827: WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the Real Estate 7 WordPress theme (versions 3.5.9 and earlier), developed by Contempo. An attacker can reach the vulnerable endpoint directly over the network without any credentials or user interaction. Successful exploitation gives the attacker read access to the underlying database and limited ability to disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token of any kind is needed; the injection is reachable by any anonymous request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, memory-layout dependencies, or other environmental factors to overcome.

Blast Radius

• Reads arbitrary database contents, including WordPress user records, hashed passwords, session tokens, and any customer or listing data stored in the database.
• Database confidentiality is fully compromised across all tables the WordPress database user can access, which in typical deployments includes the entire WordPress schema.
• The A:L (low availability) impact token indicates the attacker can partially degrade service, such as causing slow queries or locking rows, without fully crashing the database.