CVE-2026-123670: fallo de gravedad media en Essential Real Estate
Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3
The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · Essential Real EstateCVEs relacionadas — Essential Real Estate
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-6140HIGHEssential Real Estate < 4.4 - Subscriber+ Arbitrary File UploadEPSS 1.1%CVE-2022-3933MEDIUMEssential Real Estate < 3.9.6 - Reflected Cross-Site-ScriptingEPSS 0.9%CVE-2023-6139MEDIUMEssential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option UpdateEPSS 0.6%CVE-2023-6141MEDIUMEssential Real Estate < 4.4.0 - Subscriber+ Stored XSSEPSS 0.4%CVE-2026-110964MEDIUMEssential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOREPSS 0.2%CVE-2026-90963MEDIUMEssential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajaxEPSS 0.2%