The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address, and financial details. This vulnerability can lead to unauthorized access to sensitive financial information, emphasizing the ne [truncated]
MEDIUMEssential Real EstateCVE published 2026-11-05
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve images attached to unpublished property listings. This could potentially lead to unauthorized access to sensitive information. Defenders should assess exposure and prioritize verification and remediation efforts. The plu [truncated]
MEDIUMEssential Real EstateCVE published 2026-11-05
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site. This vulnerability could lead to unauthorized email sending, potentially used for phishing or spam campaigns, and may result in reputatio [truncated]
