CVE-2026-90964

Full vulnerability record from the local CVENow database.

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-05 06:17:09.853000

Last modified

2026-11-05 06:17:09.853000

View original CVE JSON

{
  "id": "CVE-2026-90964",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T06:17:09.853",
  "lastModified": "2026-11-05T06:17:09.853",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Essential Real Estate",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.3.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435/",
      "source": "[email protected]"
    }
  ]
}