CVE Intelligence
Analysis AI-assisted

CVE-2026-54827: Real Estate 7 Theme - Unauthenticated SQL Injection

CVE-2026-54827 is a critical unauthenticated SQL injection in Real Estate 7, described as affecting versions up to 3.5.9. The record lists no fixed version and no confirmed exploitation in the sources consulted. Defenders should verify installed versions and apply general hardening until vendor guidance is confirmed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54827 is a critical SQL injection vulnerability (CWE-89) reported in Real Estate 7, described as unauthenticated and affecting versions up to and including 3.5.9. The record was published on 2026-06-26 by the CNA audit@patchstack.com, and the reference path suggests a WordPress theme.

Impact

  • An unauthenticated SQL injection may allow interaction with the application database without logging in.
  • The CVSS 3.1 base score of 9.3 is reported by the CNA. Based on the vector in the record, it indicates high confidentiality impact and low availability impact with scope changed.
  • Actual data exposure depends on site configuration and database permissions, which the sources do not describe.

Affected products and versions

  • Product: Real Estate 7, apparently a WordPress theme based on the Patchstack reference path.
  • Described range: versions up to and including 3.5.9.
  • The affected list in the record is empty, so the vendor-confirmed range and any fixed version are unknown.

Exploitation status

The CISA KEV catalogue does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted. EPSS reports a probability of 0.004 with a percentile of 0.3241 in the record.

Remediation and mitigation

  • Check whether the site runs Real Estate 7 and which exact version is installed.
  • Consult the Patchstack entry and vendor channels for an updated release, since the record lists no fixed version.
  • Until a fix is confirmed, consider restricting access to the affected component, reviewing web application firewall protections, and limiting database account privileges. These are general measures, not vendor guidance.
  • Maintain verified backups.

Detection guidance

  • Review web server and application logs for unusual parameter values sent to theme components, especially repeated database error messages.
  • Monitor for unexpected database activity or unauthorized content changes.
  • The sources consulted do not publish indicators of compromise.

Limitations of the available information

  • The record has no fixed version, an empty affected product list, and no vendor advisory text beyond the short description.
  • The title field is empty in the record, and the source status is Deferred.
  • Whether the record will be updated is unknown.

Frequently asked questions

Can this vulnerability be triggered without logging in?

The record describes it as unauthenticated. It provides no further technical detail, and this analysis does not describe attack steps.

Is there a fixed version?

The record lists no fixed version. Check the Patchstack entry and vendor channels, because the absence of a listed fix does not mean no fix exists.

Is it known to be exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.