The Resideo Plugin for - Real Estate WordPress Theme plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This due the not properly validating a user's identity prior updating their details like email. makes it possible authenticated attackers, with Subscriber-level access above, change arbitrary email addresses, including administrators, leverage that reset password gain account.