CVE-2026-110964: Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Event History
Frequently Asked Questions
Who can exploit this issue?
A self-registered customer-level user can exploit it. The issue does not require administrative privileges.
What does an attacker need to delete another user's media attachment?
The attacker needs to be able to act as a customer-level user and target a media attachment belonging to another user. The plugin fails to verify ownership before deletion.
What assets are at risk?
Media library attachments owned by other users are at risk, including attachments owned by administrators.
Which plugin versions are affected?
Essential Real Estate versions 4.4.3 through 5.3.4 are affected. Version 5.3.5 is the first version identified as not affected.