CVE-2026-90963

{
  "etk_id": "ETK-2026-3601",
  "cve_id": "CVE-2026-90963",
  "display_id": "CVE-2026-90963",
  "ghsa_id": "GHSA-qrc4-9pwh-5w2x",
  "euvd_id": "EUVD-2026-117343",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass exposes unpublished listings in Essential Real Estate",
  "summary": "Essential Real Estate versions before 5.3.5 expose unpublished property listing data through an improperly protected AJAX action. An unauthenticated attacker can retrieve draft listing content and agent contact details when such listings exist.",
  "mitigation": "Update Essential Real Estate to version 5.3.5 or later. Until updating, restrict public access to the affected WordPress site where feasible and avoid storing sensitive information in unpublished listings.",
  "vendor": null,
  "product": "Essential Real Estate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.3.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.3.5"
      ],
      "package_name": "Essential Real Estate",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 31.834597183333333,
  "t0_at": "2026-11-05T06:00:26.785000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T08:31:49.431244+00:00",
      "days": 0.10512322041666666,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:26.785000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T06:00:26.785000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:26.785000+00:00",
      "url": "https://github.com/advisories/GHSA-qrc4-9pwh-5w2x"
    }
  }
}