medium · CVSS v3 5.3

CVE-2026-90963

The Essential Real Estate WordPress plugin (v<5.3.5) lacks authorization checks on an AJAX action, enabling unauthenticated users to retriev

Overview

The Essential Real Estate WordPress plugin (v<5.3.5) lacks authorization checks on an AJAX action, enabling unauthenticated users to retrieve full details of unpublished property listings, including agent contact information. This flaw exposes sensitive data that should remain private. The vulnerability is medium severity (CVSS 5.3).

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.

Impact

Confidentiality is compromised as private property and agent contact details become publicly accessible. Availability is not directly affected, but the exposure could lead to phishing or spam. The primary impact is on real‑estate agencies and their agents whose personal data is leaked.

Remediation

Update the plugin to version 5.3.5 or later where the authorization check is added. If an update is not possible, disable the vulnerable AJAX endpoint via .htaccess or a security plugin, or restrict access to authenticated users only. Monitor the site for unauthorized access attempts and review logs for suspicious activity.

Risk context

Medium severity (CVSS 5.3) with no EPSS data available. The risk is moderate; defenders should act promptly to patch or mitigate to prevent data leakage.

Affected products

  • Essential Real Estate WordPress plugin
  • WordPress plugin Essential Real Estate

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

WordPress plugin data exposure unauthenticated access real estate

← All CVEs

Related CVEs

medium

CVE-2026-122049

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

View analysis

medium

CVE-2026-105971

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

View analysis

medium

CVE-2026-122052

A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.

View analysis

medium

CVE-2026-122144

A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis