CVE-2026-90963 Details
Description
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
A vulnerability exists in the Essential Real Estate WordPress plugin in versions prior to 5.3.5. The issue arises because the plugin's AJAX action 'property_print_ajax' does not implement proper authorization or publication-status checks. This oversight allows unauthenticated users to access unpublished property listings, including sensitive information such as the listing agent's private name, email address, phone number, and office address.
Users are advised to update the Essential Real Estate WordPress plugin to version 5.3.5 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/48bbf85d-ee0f-4195-8a5f-149c7bbf2758/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Essential Real Estate | < 5.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |