[ CVE-2026-90964 · Published 5 Nov 2026 ]
Vulnerability in Unknown Essential Real Estate
Not scored yet
No fix listed yet
[ Description ]Official description
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.