CVE-2021-24238

Name of the Vulnerable Software and Affected Versions Realteo WordPress plugin versions prior to 1.2.4

Description The issue allows any authenticated users to delete arbitrary properties by tampering with the property id parameter, as the plugin does not ensure that the requested property to be deleted belongs to the user making the request.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the property deletion functionality to minimize the risk of exploitation. Avoid using the property id parameter in affected API endpoints until the issue is resolved.