---
id: "CVE-2026-90967"
kind: "vulnerability"
aliases: ["CVE-2026-90967"]
title: "Essential Real Estate WordPress plugin: any logged-in user can read others' invoices"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["essential-real-estate", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-user-accounts", "plugin-version-5.3.5-or-later"]
published_at: "2026-11-05T06:17:10+00:00"
first_seen_at: "2026-11-05T06:31:53+00:00"
updated_at: "2026-11-05T06:32:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90967", "first_seen_at": "2026-11-05T06:31:53+00:00"}]
exploit_sources: []
---

# Essential Real Estate WordPress plugin: any logged-in user can read others' invoices

The Essential Real Estate WordPress plugin before 5.3.5 does not check that an invoice belongs to the requesting user before displaying it through an AJAX action. An authenticated low-privileged user can read other users' invoices, including names, account emails and financial details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Essential Real Estate plugin in the WordPress admin plugins list; versions below `5.3.5` are in the affected range.

## Fix

- Essential Real Estate plugin: move to `5.3.5` or later.

## Timeline

- 2026-11-05T06:31:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90967

## From the sources

The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_