CVE-2026-90963 in Essential Real Estate Plugin
Summary
by MITRE • 11/05/2026
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Essential Real Estate WordPress plugin versions prior to 5.3.5 represents a critical failure in access control mechanisms within its AJAX endpoint architecture. This flaw stems from an absence of proper authorization checks when handling specific administrative or backend operations that are exposed via asynchronous JavaScript and XML requests. In secure web application design, any action that retrieves sensitive data or modifies state must verify the identity and permissions of the requesting user before proceeding. However, in this instance, the plugin fails to validate whether the requester possesses valid authentication credentials or sufficient privileges to access restricted content. This oversight allows unauthenticated actors to interact with internal system functions as if they were legitimate administrators or authorized users, bypassing standard security gateways that typically protect private data from public exposure.
The technical manifestation of this flaw involves a specific AJAX action endpoint that does not enforce publication status checks or user role verification. When an external party sends a request to this endpoint, the server processes it without confirming if the requester is logged in or has the requisite permissions. Consequently, the system returns full details for property listings regardless of their visibility settings. This means that content marked as draft, pending review, or otherwise unpublished remains accessible through direct API calls. The data exposed includes not only the textual and media contents of these real estate listings but also personally identifiable information belonging to listing agents. Specifically, the vulnerability leaks private contact details such as names, email addresses, phone numbers, and office addresses, which are typically shielded from public view in standard website interactions.
From an operational impact perspective, this vulnerability poses significant risks related to privacy compliance and professional reputation. The exposure of personally identifiable information violates principles of data minimization and confidentiality, potentially breaching regulations such as the General Data Protection Regulation or other local privacy laws depending on the jurisdiction. For real estate professionals, the unauthorized disclosure of private contact details can lead to targeted phishing attacks, harassment, or identity theft against agents. Furthermore, the ability to view unpublished listings allows competitors or malicious actors to gain insight into business strategies, pricing models, and inventory before they are officially marketed. This undermines the competitive advantage intended by keeping certain properties off public feeds until a specific launch date or marketing campaign begins.
This issue aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized access to resources. Additionally, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker exploits a lack of authentication requirements to effectively impersonate an authorized user without needing valid credentials. The attack vector is classified under remote exploitation with no additional privileges required beyond network connectivity, making it easily exploitable by automated tools or script-kiddies seeking sensitive data dumps.
Mitigation strategies must prioritize immediate patching and defensive coding practices. Users running versions of Essential Real Estate prior to 5.3.5 should update the plugin immediately to a version where these authorization checks have been implemented. Developers responsible for maintaining such plugins must ensure that all AJAX endpoints, particularly those handling sensitive data or administrative functions, enforce strict authentication verification using WordPress nonces and capability checks before processing any requests. Implementing role-based access control ensures that only users with specific permissions can trigger actions that retrieve private listing details. Furthermore, conducting regular security audits and penetration testing on custom plugins can help identify similar gaps in access logic where publication status or user roles are not adequately validated against incoming requests.