CVE-2026-123670: Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning
The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can self-register and obtain the Customer role can add arbitrary recipient addresses to the plugin's contact-email allowlist. After that, unauthenticated users can send emails with attacker-controlled content to those addresses through the site.
Is an unauthenticated attacker able to set the email recipients directly?
No. The described attack requires a self-registered Customer-role user to first add an address to the allowlist; unauthenticated users can then use the contact email action to send content to that added address.
Which plugin versions are affected?
Versions before Essential Real Estate 5.3.6 are affected. Version 5.3.6 is the first version identified as not affected by this issue.