{"id":"CVE-2026-90965","aliases":["EUVD-2026-117345","GHSA-rvw5-rgwc-mcpp"],"status":"published","title":"Essential Real Estate \u003c 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00193,"percentile":0.09075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:03:21Z","products":[{"vendor":"g5theme","product":"essential real estate"},{"vendor":"unknown","product":"essential real estate"}],"references":[{"url":"https://wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90965"},{"url":"https://wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d"},{"url":"https://github.com/advisories/GHSA-rvw5-rgwc-mcpp"}],"sources":{"cve":[{"id":"CVE-2026-90965","title":"Essential Real Estate \u003c 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","status":"published","published":"2026-11-05T06:00:27.149Z","modified":"2026-11-06T12:03:21.858Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117345","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","status":"published","published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:03:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-rvw5-rgwc-mcpp","title":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or...","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","status":"published","published":"2026-11-05T06:34:38Z","modified":"2026-11-06T15:31:26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-90965","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","status":"published","published":"2026-11-05T06:17:09.977Z","modified":"2026-11-06T13:17:32.62Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}