Unauthorized Access in Essential Real Estate Plugin for WordPress
CVE-2026-90965
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-90965?
The Essential Real Estate plugin for WordPress, before version 5.3.5, lacks necessary checks for publication status and user authorization in two AJAX functionalities. This oversight permits unauthenticated users to access and download images linked to property listings that have not yet been published, posing a risk of exposing sensitive information. It is vital for users of this plugin to update to the latest version to mitigate this vulnerability.
Affected Version(s)
Essential Real Estate 0 < 5.3.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.