Unrated severityNVD Advisory· Published Nov 4, 2026

CVE-2026-110964

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

Affected products

WordPress/Essential Real Estatellm-fuzzy
Range: <5.3.5
Package: https://wordpress.org/plugins/essential-real-estate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000