Unrated severityNVD Advisory· Published Nov 5, 2026

CVE-2026-90965

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Essential Real Estatellm-fuzzy
Range: <5.3.5
Package: https://wordpress.org/plugins/essential-real-estate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000