{"id":"CVE-2026-123670","kind":"vulnerability","aliases":["CVE-2026-123670"],"related":[],"title":"Essential Real Estate WordPress plugin lets attackers send email to any address","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","summary":"The Essential Real Estate WordPress plugin before 5.3.6 does not check that the recipients allowed for its contact email action are legitimate. A user with the self-registered Customer role can add any address to that allowlist, and unauthenticated visitors can then send attacker-controlled email content to it through the site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["essential-real-estate","package","self-hosted","wordpress"],"not_affected_if":["no-customer-self-registration","plugin-at-5.3.6-or-later"],"how_to_check":"- Check the installed version of the Essential Real Estate plugin in the WordPress admin under Plugins; versions before `5.3.6` are affected.\n- Check whether open customer self-registration is enabled on the site.","fix":"- Essential Real Estate plugin: move to `5.3.6` or later.","status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:30+00:00","updated_at":"2026-11-13T06:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T06:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Real Estate plugin: move to `5.3.6` or later.","reach":"internet","title":"Essential Real Estate WordPress plugin lets attackers send email to any address","impact":"medium","summary":"The Essential Real Estate WordPress plugin before 5.3.6 does not check that the recipients allowed for its contact email action are legitimate. A user with the self-registered Customer role can add any address to that allowlist, and unauthenticated visitors can then send attacker-controlled email content to it through the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","essential-real-estate","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attackers send arbitrary email content to any address via the site","analyst_note":"","how_to_check":"- Check the installed version of the Essential Real Estate plugin in the WordPress admin under Plugins; versions before `5.3.6` are affected.\n- Check whether open customer self-registration is enabled on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-5.3.6-or-later","no-customer-self-registration"],"who_is_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.6 that allow self-registration of Customer accounts. The flaw lets attackers use the site's contact form to send email to arbitrary recipients, so sites without customer self-registration or with the plugin disabled are less exposed. The sources do not say whether the contact action is on by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4548,"output_tokens":593,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123670':15A,18A '-2026':14A,17A '5.3.6':35B,89C 'action':47B,102C 'add':60B,115C 'address':12A,62B,117C 'allow':42B,97C,105C 'allowlist':65B,120C 'attack':7A,73B,131C 'attacker-control':72B,130C 'check':38B 'contact':45B,100C 'content':76B,133C 'control':74B,132C 'custom':57B,112C 'cve':13A,16A 'email':9A,46B,75B,101C,128C 'essenti':1A,20B,29B,83C 'essential-real-est':19B 'estat':3A,22B,31B,85C 'host':26B 'legitim':49B,104C 'let':6A 'packag':23B 'plugin':5A,33B,87C 'real':2A,21B,30B,84C 'recipi':41B,95C 'regist':56B,111C 'role':58B,113C 'self':25B,55B,110C 'self-host':24B 'self-regist':54B,109C 'send':8A,71B,127C 'site':81B,138C 'unauthent':67B,123C 'user':51B,106C,124C 'verifi':92C 'visitor':68B 'wordpress':4A,27B,32B,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.6 that allow self-registration of Customer accounts. The flaw lets attackers use the site's contact form to send email to arbitrary recipients, so sites without customer self-registration or with the plugin disabled are less exposed. The sources do not say whether the contact action is on by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["essentialrealestate","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123670':15A,18A '-2026':14A,17A 'address':12A 'attack':7A 'cve':13A,16A 'email':9A 'essenti':1A 'estat':3A 'let':6A 'plugin':5A 'real':2A 'send':8A 'wordpress':4A","search_b":"'5.3.6':35B 'action':47B 'add':60B 'address':62B 'allow':42B 'allowlist':65B 'attack':73B 'attacker-control':72B 'check':38B 'contact':45B 'content':76B 'control':74B 'custom':57B 'email':46B,75B 'essenti':20B,29B 'essential-real-est':19B 'estat':22B,31B 'host':26B 'legitim':49B 'packag':23B 'plugin':33B 'real':21B,30B 'recipi':41B 'regist':56B 'role':58B 'self':25B,55B 'self-host':24B 'self-regist':54B 'send':71B 'site':81B 'unauthent':67B 'user':51B 'visitor':68B 'wordpress':27B,32B","search_c":"'5.3.6':89C 'action':102C 'add':115C 'address':117C 'allow':97C,105C 'allowlist':120C 'attack':131C 'attacker-control':130C 'contact':100C 'content':133C 'control':132C 'custom':112C 'email':101C,128C 'essenti':83C 'estat':85C 'legitim':104C 'plugin':87C 'real':84C 'recipi':95C 'regist':111C 'role':113C 'self':110C 'self-regist':109C 'send':127C 'site':138C 'unauthent':123C 'user':106C,124C 'verifi':92C 'wordpress':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123670","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}