ghsa-x8r8-2rh2-5h4p

github
Description

The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [],
  "aliases": [
    "CVE-2026-90967"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-05T06:17:10Z",
    "severity": null
  },
  "details": "The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.",
  "id": "GHSA-x8r8-2rh2-5h4p",
  "modified": "2026-11-05T06:34:38Z",
  "published": "2026-11-05T06:34:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90967"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/745cf24b-2dbd-41ea-b26d-d1c6f0a25de9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
View JSON API Download JSON