{"id":"CVE-2026-90964","kind":"vulnerability","aliases":["CVE-2026-90964"],"related":[],"title":"Essential Real Estate WordPress plugin: contact form sends mail to any address","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.","summary":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions. An unauthenticated visitor can use the site to send email to arbitrary addresses with a chosen sender header and message body.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["essential-real-estate","package","self-hosted","wordpress"],"not_affected_if":["plugin-version-5.3.5-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if it is below `5.3.5`.\n- Confirm the plugin is active on the site.","fix":"- Essential Real Estate plugin: move to `5.3.5` or later.","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:00+00:00","updated_at":"2026-11-05T06:33:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:00Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Real Estate plugin: move to `5.3.5` or later.","reach":"internet","title":"Essential Real Estate WordPress plugin: contact form sends mail to any address","impact":"low","summary":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions. An unauthenticated visitor can use the site to send email to arbitrary addresses with a chosen sender header and message body.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","essential-real-estate","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Site used as an open relay for spam or phishing email","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; affected if it is below `5.3.5`.\n- Confirm the plugin is active on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-5.3.5-or-later"],"who_is_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.5 that expose its contact email action to visitors. The sources do not describe further configuration conditions, so any site with the plugin below the fixed version should be treated as exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":4206,"output_tokens":497,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90964':15A,18A '5.3.5':35B,76C 'action':47B,88C 'address':12A,60B,97C 'allow':89C 'arbitrari':59B,96C 'attack':101C 'attacker-control':100C 'bodi':68B,107C 'chosen':63B 'contact':6A,45B,86C 'control':102C 'cve':13A,16A 'email':46B,57B,87C,94C 'essenti':1A,20B,29B,70C 'essential-real-est':19B 'estat':3A,22B,31B,72C 'form':7A 'header':65B,104C 'host':26B 'mail':9A 'messag':67B,106C 'one':42B,83C 'packag':23B 'plugin':5A,33B,74C 'real':2A,21B,30B,71C 'recipi':40B,81C 'restrict':38B,79C 'self':25B 'self-host':24B 'send':8A,56B,93C 'sender':64B,103C 'site':54B,110C 'unauthent':49B,90C 'use':52B 'user':91C 'visitor':50B 'wordpress':4A,27B,32B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Real Estate WordPress plugin before 5.3.5 that expose its contact email action to visitors. The sources do not describe further configuration conditions, so any site with the plugin below the fixed version should be treated as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["essentialrealestate","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90964","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}