CVE-2026-90965
Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
| Vendor | unknown |
| Product | essential real estate |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown essential real estate
Be the first to know when new unknown vulnerabilities affecting unknown essential real estate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Essential Real Estate
0 < 5.3.5
References
Credits
Artus KG WPScan