RealHomes CRM Plugin Flaw Affected 30,000 WordPress Sites

A critical arbitrary-file-upload vulnerability (CVE-2025-67968) in the RealHomes CRM plugin—bundled with the RealHomes WordPress theme used on over 30,000 sites—allowed any logged-in Subscriber or higher to upload malicious files via a CSV import AJAX handler due to missing permission checks and lack of filetype validation; the issue has been patched in RealHomes CRM 1.0.1 which adds capability checks and filetype validation, and users are advised to update.