CVE-2026-90967 in Essential Real Estate Plugin
Summary
by MITRE • 11/05/2026
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Essential Real Estate WordPress plugin versions prior to 5.3.5 represents a critical failure in access control mechanisms within the application’s AJAX handling logic. This flaw specifically stems from an insufficient verification of resource ownership when processing requests related to invoice generation and retrieval. In secure web applications, any action that involves sensitive data must strictly validate that the requesting user has legitimate authorization for the specific resource being accessed. However, this plugin fails to implement such checks during its AJAX operations, effectively allowing authenticated users with low-privileged roles to bypass intended restrictions on private financial documents.
From a technical perspective, the core issue lies in the server-side processing of AJAX requests where invoice data is rendered or returned to the client side. The application accepts parameters identifying an invoice but does not cross-reference these identifiers against the identity and permissions of the authenticated user making the request. This lack of object-level authorization control means that if a malicious actor can guess or enumerate valid invoice IDs, they can retrieve the associated documents regardless of who owns them. This type of flaw is classically categorized under CWE-284 Improper Access Control, as it allows an attacker to access resources belonging to other users without proper permission checks.
The operational impact of this vulnerability is severe due to the sensitive nature of the data exposed. Invoices contain personally identifiable information and financial details that are critical for privacy compliance and business integrity. Specifically, attackers can extract the invoice owner's full name, account email address, and detailed financial information such as payment amounts, dates, and potentially banking or credit card references depending on how invoices are structured in the plugin. This exposure not only violates user trust but also facilitates further attacks such as targeted phishing campaigns using real names and contact details, or social engineering attempts leveraging specific transactional data to appear legitimate.
This vulnerability aligns with several tactics defined by the MITRE ATT&CK framework for enterprise security. It falls under the Initial Access category via Valid Accounts, as it requires authentication but exploits weak authorization logic rather than credential theft. Furthermore, the exploitation of this flaw constitutes Data Exfiltration over a Command and Control channel or an Application Layer Protocol, specifically leveraging AJAX requests to silently pull sensitive data from the server without triggering typical intrusion detection alerts associated with direct file downloads. The ability to read other users' invoices also supports Reconnaissance activities by allowing attackers to map out user relationships and financial behaviors within the platform ecosystem.
To mitigate this vulnerability, immediate action is required for all administrators running versions of Essential Real Estate prior to 5.3.5. The primary remediation step is upgrading the plugin to version 5.3.5 or later, where the developers have implemented proper ownership verification checks in the AJAX handlers. Until an upgrade can be performed, site administrators should consider restricting access to WordPress admin areas through IP whitelisting if possible and ensuring that all user accounts adhere to the principle of least privilege. Additionally, implementing a Web Application Firewall with rules designed to detect anomalous patterns in AJAX requests targeting sensitive endpoints may provide temporary protection against automated exploitation attempts while patching is underway. Regular security audits and code reviews focusing on access control logic are recommended to prevent similar flaws from being introduced in future updates or custom integrations.