CVE-2026-90964: Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending

Q: Who can exploit this issue?

Any unauthenticated user can exploit it through a vulnerable site running Essential Real Estate before version 5.3.5. No account or prior access is required.

Q: What can an attacker do with this vulnerability?

An attacker can cause the site to send emails to arbitrary recipient addresses. They can control the sender header and the message body, which could support phishing or abuse of the site's mail-sending capability.

Q: How can I determine whether my site is affected?

Check the installed Essential Real Estate plugin version. Versions earlier than 5.3.5 are affected.

Published Nov 5, 2026

Updated

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Essential Real Estate WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.3.5

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can exploit it through a vulnerable site running Essential Real Estate before version 5.3.5. No account or prior access is required.

What can an attacker do with this vulnerability?

An attacker can cause the site to send emails to arbitrary recipient addresses. They can control the sender header and the message body, which could support phishing or abuse of the site's mail-sending capability.

How can I determine whether my site is affected?

Check the installed Essential Real Estate plugin version. Versions earlier than 5.3.5 are affected.

CVE-2026-90964: Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with this vulnerability?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with this vulnerability?

How can I determine whether my site is affected?