{"id":"CVE-2026-90966","aliases":["EUVD-2026-117346","GHSA-qm9j-xm9j-x4x3"],"status":"published","title":"Essential Real Estate \u003c 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00152,"percentile":0.04418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:03:07Z","products":[{"vendor":"g5theme","product":"essential real estate"},{"vendor":"unknown","product":"essential real estate"}],"references":[{"url":"https://wpscan.com/vulnerability/445a0351-d452-412e-8145-d427e10e0948/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90966"},{"url":"https://wpscan.com/vulnerability/445a0351-d452-412e-8145-d427e10e0948"},{"url":"https://github.com/advisories/GHSA-qm9j-xm9j-x4x3"}],"sources":{"cve":[{"id":"CVE-2026-90966","title":"Essential Real Estate \u003c 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","status":"published","published":"2026-11-05T06:00:27.333Z","modified":"2026-11-06T12:03:07.379Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117346","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","status":"published","published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:03:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-qm9j-xm9j-x4x3","title":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX...","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","status":"published","published":"2026-11-05T06:34:38Z","modified":"2026-11-06T15:31:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-90966","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","status":"published","published":"2026-11-05T06:17:10.087Z","modified":"2026-11-06T13:17:32.797Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}