---
id: "CVE-2026-90963"
kind: "vulnerability"
aliases: ["CVE-2026-90963"]
title: "Essential Real Estate WordPress plugin: unpublished listings and agent contacts exposed"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["essential-real-estate", "package", "real-estate-sites", "wordpress"]
not_affected_if: ["plugin-5.3.5-or-later"]
published_at: "2026-11-05T06:17:09+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90963", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# Essential Real Estate WordPress plugin: unpublished listings and agent contacts exposed

The Essential Real Estate WordPress plugin before 5.3.5 has an AJAX action that skips authorization and publication-status checks. An unauthenticated visitor can read unpublished property listings and the private name, email, phone and office address of the listing agent.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; the sources do not give a command.
- Look for the plugin folder `essential-real-estate` and confirm whether its version is below `5.3.5`.

## Fix

- Essential Real Estate plugin: move to `5.3.5` or later.

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90963

## From the sources

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_