CVE-2026-90963: Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax

Q: Which sites are exposed to this issue?

WordPress sites using Essential Real Estate versions earlier than 5.3.5 are affected. The issue is reachable without authentication through the plugin's property_print_ajax action.

Q: What information can an attacker obtain?

An unauthenticated attacker can read the full contents of unpublished property listings. They can also obtain the associated listing agent's private name, email address, phone number, and office address.

Q: Does exploitation require a user account or special permissions?

No. The vulnerable AJAX action lacks authorization and publication-status checks, so unauthenticated users can access the affected information.

Published Nov 5, 2026

Updated

The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

WordPress sites using Essential Real Estate versions earlier than 5.3.5 are affected. The issue is reachable without authentication through the plugin's property_print_ajax action.

What information can an attacker obtain?

An unauthenticated attacker can read the full contents of unpublished property listings. They can also obtain the associated listing agent's private name, email address, phone number, and office address.

Does exploitation require a user account or special permissions?

No. The vulnerable AJAX action lacks authorization and publication-status checks, so unauthenticated users can access the affected information.

CVE-2026-90963: Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What information can an attacker obtain?

Does exploitation require a user account or special permissions?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What information can an attacker obtain?

Does exploitation require a user account or special permissions?