ghsa-vg34-wjj2-chfw

github
Description

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [],
  "aliases": [
    "CVE-2026-90964"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-05T06:17:09Z",
    "severity": null
  },
  "details": "The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.",
  "id": "GHSA-vg34-wjj2-chfw",
  "modified": "2026-11-05T06:34:38Z",
  "published": "2026-11-05T06:34:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90964"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
View JSON API Download JSON