{"id":"CVE-2026-90963","kind":"vulnerability","aliases":["CVE-2026-90963"],"related":[],"title":"Essential Real Estate WordPress plugin: unpublished listings and agent contacts exposed","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.","summary":"The Essential Real Estate WordPress plugin before 5.3.5 has an AJAX action that skips authorization and publication-status checks. An unauthenticated visitor can read unpublished property listings and the private name, email, phone and office address of the listing agent.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["essential-real-estate","package","real-estate-sites","wordpress"],"not_affected_if":["plugin-5.3.5-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not give a command.\n- Look for the plugin folder `essential-real-estate` and confirm whether its version is below `5.3.5`.","fix":"- Essential Real Estate plugin: move to `5.3.5` or later.","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:01+00:00","updated_at":"2026-11-05T06:33:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Real Estate plugin: move to `5.3.5` or later.","reach":"internet","title":"Essential Real Estate WordPress plugin: unpublished listings and agent contacts exposed","impact":"medium","summary":"The Essential Real Estate WordPress plugin before 5.3.5 has an AJAX action that skips authorization and publication-status checks. An unauthenticated visitor can read unpublished property listings and the private name, email, phone and office address of the listing agent.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","real-estate-sites","essential-real-estate"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unpublished listings and agent personal contact details readable by anyone","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources do not give a command.\n- Look for the plugin folder `essential-real-estate` and confirm whether its version is below `5.3.5`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-5.3.5-or-later"],"who_is_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.5 that expose its AJAX actions to anonymous visitors. Unpublished listings and agent contact details can be read without logging in. Sites not running this plugin, or running 5.3.5 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4215,"output_tokens":541,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90963':14A,17A '5.3.5':35B,76C 'action':39B,92C 'address':64B,115C,120C 'agent':9A,68B,124C 'ajax':38B,91C 'allow':93C 'author':42B,81C 'check':47B,86C 'contact':10A 'content':100C 'cve':12A,15A 'email':60B,114C 'essenti':1A,19B,29B,70C 'essential-real-est':18B 'estat':3A,21B,25B,31B,72C 'expos':11A 'full':99C 'list':7A,55B,67B,103C,123C 'name':59B,113C 'number':117C 'offic':63B,119C 'one':88C 'packag':22B 'perform':79C 'phone':61B,116C 'plugin':5A,33B,74C 'privat':58B,112C 'properti':54B,102C 'public':45B,84C 'publication-status':44B,83C 'publish':108C 'read':52B,97C 'real':2A,20B,24B,30B,71C 'real-estate-sit':23B 'site':26B 'skip':41B 'status':46B,85C 'togeth':109C 'unauthent':49B,94C 'unpublish':6A,53B 'user':95C 'visitor':50B 'wordpress':4A,27B,32B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.5 that expose its AJAX actions to anonymous visitors. Unpublished listings and agent contact details can be read without logging in. Sites not running this plugin, or running 5.3.5 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["essentialrealestate","high","package","realestatesites","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90963","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}