CVE-2026-90963
Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
Exploit likelihood
What each source reports
CVE List No score
Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajax
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Record
CVE-2026-90963- Updated
- 2026-11-05
EUVDEUVD-2026-117343 No score
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Record
EUVD-2026-117343- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-qrc4-9pwh-5w2x No score
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or...
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Record
GHSA-qrc4-9pwh-5w2x- Updated
- 2026-11-05
NVD No score
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
- Record
CVE-2026-90963- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90963 is a vulnerability with no CVSS score yet in G5theme Essential Real Estate, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. No source names a fixed version.