{"id":"CVE-2026-90965","kind":"vulnerability","aliases":["CVE-2026-90965"],"related":[],"title":"Essential Real Estate WordPress plugin exposes unpublished listing images to anyone","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","summary":"The Essential Real Estate WordPress plugin before 5.3.5 has two AJAX actions that skip publication-status and authorization checks. An unauthenticated visitor can retrieve images attached to property listings that have not been published.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["essential-real-estate","package","real-estate-sites","wordpress"],"not_affected_if":["no-unpublished-listings","plugin-version-5.3.5-or-later"],"how_to_check":null,"fix":"- Essential Real Estate plugin: move to `5.3.5` or later (per the description, versions before 5.3.5 are affected)","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:53+00:00","triaged_at":"2026-11-05T06:33:00+00:00","updated_at":"2026-11-05T06:33:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:00Z","model":"claude-haiku-5-5","output":{"fix":"- Essential Real Estate plugin: move to `5.3.5` or later (per the description, versions before 5.3.5 are affected)","reach":"internet","title":"Essential Real Estate WordPress plugin exposes unpublished listing images to anyone","impact":"low","summary":"The Essential Real Estate WordPress plugin before 5.3.5 has two AJAX actions that skip publication-status and authorization checks. An unauthenticated visitor can retrieve images attached to property listings that have not been published.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","essential-real-estate","real-estate-sites"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unpublished property listing images readable by anyone on the internet","analyst_note":"","how_to_check":"unknown","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-5.3.5-or-later","no-unpublished-listings"],"who_is_affected":"Sites running the Essential Real Estate WordPress plugin below 5.3.5 that list properties. Exposure is limited to images of listings that are not yet published, so sites without draft or private listings have less at stake. Sites not using this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":4197,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90965':14A,17A '5.3.5':35B,70C 'action':39B,86C 'ajax':38B,85C 'allow':87C 'anyon':11A 'attach':54B,94C 'author':46B,79C 'check':47B,80C 'cve':12A,15A 'essenti':1A,19B,29B,64C 'essential-real-est':18B 'estat':3A,21B,25B,31B,66C 'expos':6A 'imag':9A,53B,93C 'list':8A,57B,97C 'packag':22B 'perform':73C 'plugin':5A,33B,68C 'properti':56B,96C 'public':43B,76C 'publication-status':42B,75C 'publish':62B,102C 'real':2A,20B,24B,30B,65C 'real-estate-sit':23B 'retriev':52B,91C 'site':26B 'skip':41B 'status':44B,77C 'two':37B,82C 'unauthent':49B,88C 'unpublish':7A 'user':89C 'visitor':50B 'wordpress':4A,27B,32B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Essential Real Estate WordPress plugin below 5.3.5 that list properties. Exposure is limited to images of listings that are not yet published, so sites without draft or private listings have less at stake. Sites not using this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["essentialrealestate","medium","package","realestatesites","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90965","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:53+00:00","fetched_at":"2026-11-05T06:31:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}