CVE-2026-90967: Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR

Q: Who can exploit this issue?

An authenticated low-privileged user can exploit it. The vulnerable AJAX action does not verify that the requesting user owns the invoice being rendered.

Q: What information could be exposed?

Other users' invoices may be readable, including the invoice owner's name, account email address, and financial details.

Q: Which versions are affected?

Essential Real Estate versions before 5.3.5 are affected.

Published Nov 5, 2026

Updated

The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privileged user can exploit it. The vulnerable AJAX action does not verify that the requesting user owns the invoice being rendered.

What information could be exposed?

Other users' invoices may be readable, including the invoice owner's name, account email address, and financial details.

Which versions are affected?

Essential Real Estate versions before 5.3.5 are affected.

CVE-2026-90967: Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which versions are affected?