{"id":"CVE-2026-123670","aliases":["EUVD-2026-124846","GHSA-357g-jxh5-c9w4"],"status":"published","title":"Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-13","score":0.00137,"percentile":0.03154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-11-13T06:00:08Z","modified":"2026-11-13T18:53:16Z","products":[{"vendor":"g5theme","product":"essential real estate"},{"vendor":"unknown","product":"essential real estate"}],"references":[{"url":"https://wpscan.com/vulnerability/04d772fe-001d-4f25-a11a-dedf16064ce4/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123670"},{"url":"https://wpscan.com/vulnerability/04d772fe-001d-4f25-a11a-dedf16064ce4"},{"url":"https://github.com/advisories/GHSA-357g-jxh5-c9w4"}],"sources":{"cve":[{"id":"CVE-2026-123670","title":"Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","status":"published","published":"2026-11-13T06:00:08.415Z","modified":"2026-11-13T18:53:16.09Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-13T19:33:35.076876Z"}],"euvd":[{"id":"EUVD-2026-124846","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","status":"published","published":"2026-11-13T06:00:08Z","modified":"2026-11-13T18:53:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-13T20:40:11.228096Z"}],"ghsa":[{"id":"GHSA-357g-jxh5-c9w4","title":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it...","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","status":"published","published":"2026-11-13T06:31:43Z","modified":"2026-11-13T21:31:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-13T21:53:56.324277Z"}],"nvd":[{"id":"CVE-2026-123670","description":"The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.","status":"published","published":"2026-11-13T06:16:53.587Z","modified":"2026-11-13T19:19:20.167Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-13T21:37:35.339654Z"}]}}