CVE-2026-90967 · Package
NO FIX YET · SEE WHAT TO DO
The Essential Real Estate WordPress plugin before 5.3.5 does not check that an invoice belongs to the requesting user before displaying it through an AJAX action. An authenticated low-privileged user can read other users' invoices, including names, account emails and financial details.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Essential Real Estate WordPress plugin before 5.3.5 that let users log in and hold invoices. The flaw needs a logged-in account of any low privilege level, so sites with open or customer registration are the most exposed; sites with no user accounts can skip it.
Not affected if no-user-accounts, plugin-version-5.3.5-or-later
Who cares essential-real-estate, self-hosted, wordpress
5.3.5 are in the affected range.5.3.5 or later.The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.