---
id: "CVE-2026-123670"
page: "https://infrastack.ai/live/CVE-2026-123670"
kind: "vulnerability"
aliases: ["CVE-2026-123670"]
title: "Essential Real Estate WordPress plugin lets attackers send email to any address"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["essential-real-estate", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-customer-self-registration", "plugin-at-5.3.6-or-later"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:42:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123670", "first_seen_at": "2026-11-13T06:42:16+00:00"}]
exploit_sources: []
---

# Essential Real Estate WordPress plugin lets attackers send email to any address

Link for people: https://infrastack.ai/live/CVE-2026-123670 (this .md is for agents)

The Essential Real Estate WordPress plugin before 5.3.6 does not check that the recipients allowed for its contact email action are legitimate. A user with the self-registered Customer role can add any address to that allowlist, and unauthenticated visitors can then send attacker-controlled email content to it through the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Essential Real Estate plugin in the WordPress admin under Plugins; versions before `5.3.6` are affected.
- Check whether open customer self-registration is enabled on the site.

## Fix

- Essential Real Estate plugin: move to `5.3.6` or later.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123670

## From the sources

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_