---
id: CVE-2026-90965
title: >-
  Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image
  Disclosure
summary: >-
  The Essential Real Estate WordPress plugin before 5.3.5 does not perform a
  publication-status or authorization check in two of its AJAX actions, allowing
  unauthenticated users to retrieve the images attached to property listings
  that hav…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: Essential Real Estate
affected:
  - essential_real_estate < 5.3.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:50:32.326373Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:03:21.858Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90965'
references:
  - url: 'https://wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d/'
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.09034
ingestedAt: '2026-11-05T21:36:00.782Z'
---

## Overview

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.

## Affected

- `essential_real_estate < 5.3.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.