CVE-2026-90967
Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
Exploit likelihood
What each source reports
CVE List No score
Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Record
CVE-2026-90967- Updated
- 2026-11-05
EUVDEUVD-2026-117347 No score
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Record
EUVD-2026-117347- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-x8r8-2rh2-5h4p No score
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice...
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Record
GHSA-x8r8-2rh2-5h4p- Updated
- 2026-11-05
NVD No score
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
- Record
CVE-2026-90967- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90967 is a vulnerability with no CVSS score yet in G5theme Essential Real Estate, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.