Unrated severityNVD Advisory· Published Nov 5, 2026

CVE-2026-90964

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.

Affected products

WordPress/Essential Real Estatellm-fuzzy
Range: <5.3.5
Package: https://wordpress.org/plugins/essential-real-estate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000