CVE-2026-110964 · Package
NO FIX YET · SEE WHAT TO DO
The Essential Real Estate WordPress plugin before 5.3.5 does not check that a media attachment belongs to the user deleting it. A self-registered customer-level account can delete media library files owned by other users, including administrators.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
WordPress sites running the Essential Real Estate plugin older than 5.3.5 that allow users to self-register as customers. An attacker needs a registered account, so sites with registration closed or with no such plugin are not exposed.
Not affected if plugin-not-installed, registration-disabled, version-5.3.5-or-later
Who cares essential-real-estate, self-registration, wordpress
5.3.5 are affected.5.3.5 or later.The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.