Improper Access Control in Essential Real Estate Plugin for WordPress
CVE-2026-90967
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-90967?
The Essential Real Estate plugin for WordPress prior to version 5.3.5 contains an access control vulnerability that permits low-privileged authenticated users to access and read invoices belonging to other users. The flaw arises from the plugin's failure to validate user ownership of an invoice during AJAX operations, leading to potential exposure of sensitive financial information including the invoice owner's name and email address.
Affected Version(s)
Essential Real Estate 0 < 5.3.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.