CVE-2026-123670
Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.
| Vendor | unknown |
| Product | essential real estate |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown essential real estate
Be the first to know when new unknown vulnerabilities affecting unknown essential real estate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Essential Real Estate
5.3.5 < 5.3.6
References
Credits
Aabideen Bangash WPScan