---
id: "CVE-2026-90964"
kind: "vulnerability"
aliases: ["CVE-2026-90964"]
title: "Essential Real Estate WordPress plugin: contact form sends mail to any address"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["essential-real-estate", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-version-5.3.5-or-later"]
published_at: "2026-11-05T06:17:09+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90964", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# Essential Real Estate WordPress plugin: contact form sends mail to any address

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions. An unauthenticated visitor can use the site to send email to arbitrary addresses with a chosen sender header and message body.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; affected if it is below `5.3.5`.
- Confirm the plugin is active on the site.

## Fix

- Essential Real Estate plugin: move to `5.3.5` or later.

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90964

## From the sources

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_