The RealHomes WordPress theme and its accompanying Easy Real Estate plugin are plagued by two (2) critical vulnerabilities, CVE-2024-32444 and CVE-2024-32555, which impact over 23,000 websites and have a CVSS scores of 9.8/10. These unauthenticated privilege escalation flaws allow attackers to gain administrative control of affected websites. In the RealHomes theme, improper validation in the “inspiry_ajax_register” function lets attackers assign themselves administrator privileges during account registration by manipulating HTTP requests. Similarly, the Easy Real Estate plugin’s “ere_social_register” function enables attackers to log in as administrators using an administrator’s email address due to insufficient email verification. Despite Patchstack’s discovery of these vulnerabilities in September 2024 and multiple notifications to the vendor, InspiryThemes has not released security patches, leaving the vulnerabilities exploitable. These issues can result in full site takeovers, including content manipulation, malicious script injection, and sensitive data breaches. CTIX analysts strongly advise website administrators to disable the theme and plugin immediately, restrict user registrations, and monitor for updates while considering third-party security solutions for proactive protection. These vulnerabilities highlight the critical need for secure coding practices, including rigorous input validation, in WordPress themes and plugins.