CVE-2025-48126 is a high severity PHP file inclusion flaw (CVSS 8.1) in the Essential Real Estate WordPress plugin from g5theme. It affects versions up to and including 5.2.9 and allows local file inclusion. The record gives no fixed version, so update from the plugin page and check its changelog.
What's affected
Per the CVE record, Essential Real Estate (plugin slug essential-real-estate) from g5theme is affected in versions from n/a through 5.2.9. That means every release up to and including 5.2.9 is in scope.
The record describes the issue as improper control of the filename for an include or require statement in a PHP program, which allows PHP local file inclusion. It is filed under CWE-98 (PHP Remote File Inclusion).
The record does not name a fixed version. Its only reference is a Patchstack database entry, and the title of that page uses a different version number, so do not assume a particular release is safe from this record alone. Read the plugin changelog and the Patchstack entry, and install the newest release.
The base vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack complexity is rated high, which holds the score at 8.1, but there is no privilege or interaction requirement, and the impact on confidentiality, integrity and availability is high.
How to check if you're exposed
Plugins are listed with their versions in the WordPress admin under Plugins. From the command line, with WP-CLI:
wp plugin list --name=essential-real-estate --fields=name,version,status
Run it on every site you manage, including staging copies and sites that are not actively edited. A plugin that is installed but inactive is still on disk, and some flaws can be reached whether or not the plugin is switched on, so remove plugins you do not use.
Then compare the version you see with the affected range above. If you manage many sites, a plugin inventory from your management tool or a dependency scan will save time.
What to do now
- Update Essential Real Estate to the newest release available from the vendor, and read the changelog for security notes.
- If the plugin is not essential to the site, deactivate it and delete it.
- Keep file permissions tight, so that the web server user cannot write to plugin and theme folders it has no reason to change.
- Check your web logs for unusual requests to the plugin paths, and look for files in upload folders that do not belong.
- Confirm that PHP upload directories do not execute scripts, since file inclusion flaws are worse when an attacker can place a file.
- Take a backup before updating, and test the property search and listing pages afterwards.
Why it matters
Local file inclusion happens when a PHP program builds the name of a file to load from something a visitor can influence. If the name is not restricted to a safe list, the program may load files it was never meant to. Depending on the server, that can expose configuration files, or run attacker-influenced code if the attacker can get a file onto the disk.
The class is PHP remote file inclusion, which also covers the local variant. The reliable fix is to avoid choosing files from input at all, or to map input to a fixed list of allowed names.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. Real estate sites also collect enquiry forms and agent details, so the data at stake often includes personal information.
Quick check
Which version fixes CVE-2025-48126?
The record does not say. It lists versions up to 5.2.9 as affected. Install the newest release from the vendor and read its changelog to confirm.
Does deactivating the plugin help?
It reduces exposure, but delete plugins you do not use. An inactive plugin still sits on the server, and some flaws can be reached whether or not it is active.
Sources
Last reviewed: 18 October 2026.
