CVE-2026-90963 · Package
NO FIX YET · SEE WHAT TO DO
The Essential Real Estate WordPress plugin before 5.3.5 has an AJAX action that skips authorization and publication-status checks. An unauthenticated visitor can read unpublished property listings and the private name, email, phone and office address of the listing agent.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Essential Real Estate WordPress plugin before 5.3.5 that expose its AJAX actions to anonymous visitors. Unpublished listings and agent contact details can be read without logging in. Sites not running this plugin, or running 5.3.5 or later, are not affected.
Not affected if plugin-5.3.5-or-later
Who cares essential-real-estate, real-estate-sites, wordpress
essential-real-estate and confirm whether its version is below 5.3.5.5.3.5 or later.The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.