Unauthenticated Data Exposure in Essential Real Estate Plugin for WordPress
CVE-2026-90963
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2026
Badges
What is CVE-2026-90963?
The Essential Real Estate plugin for WordPress, prior to version 5.3.5, is susceptible to an authorization bypass in one of its AJAX functionalities. This flaw enables attackers to access and retrieve unpublished property details, including sensitive information such as the listing agent's private name, email address, phone number, and office address, without needing any authentication. This lack of proper authorization checks can expose personal data and sensitive business information, making it critical for users to update to the latest version to mitigate potential risks.
Affected Version(s)
Essential Real Estate 0 < 5.3.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.