CVE-2026-123670 · Package
NO FIX YET · SEE WHAT TO DO
The Essential Real Estate WordPress plugin before 5.3.6 does not check that the recipients allowed for its contact email action are legitimate. A user with the self-registered Customer role can add any address to that allowlist, and unauthenticated visitors can then send attacker-controlled email content to it through the site.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Essential Real Estate WordPress plugin before 5.3.6 that allow self-registration of Customer accounts. The flaw lets attackers use the site's contact form to send email to arbitrary recipients, so sites without customer self-registration or with the plugin disabled are less exposed. The sources do not say whether the contact action is on by default.
Not affected if no-customer-self-registration, plugin-at-5.3.6-or-later
Who cares essential-real-estate, self-hosted, wordpress
5.3.6 are affected.5.3.6 or later.The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.