6.5
Medium
CVE-2026-110964 Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
Description
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Essential Real Estate 4.4 | 4.4.3 → < 5.3.5 | 5.3.5 |
Other CVEs of Essential Real Estate
The 10 CVEs of Essential Real Estate →
CVE-2026-90967
Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR
4.3
Medium
CVE-2026-90966
Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax
4.3
Medium
CVE-2026-90965
Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure
5.3
Medium
CVE-2026-90964
Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending
5.3
Medium