CVE-2025-2891: Contempoinc Real Estate 7 WordPress

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.

Affected products

• Contempoinc Real Estate 7 WordPress: up to and including 3.5.4

Published 2025-04-01. Last modified 2026-06-17.