CVE-2026-90965

{
  "etk_id": "ETK-2026-3598",
  "cve_id": "CVE-2026-90965",
  "display_id": "CVE-2026-90965",
  "ghsa_id": "GHSA-rvw5-rgwc-mcpp",
  "euvd_id": "EUVD-2026-117345",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Access control flaw in Essential Real Estate",
  "summary": "Essential Real Estate WordPress plugin versions before 5.3.5 do not properly restrict certain AJAX requests. An unauthenticated user may retrieve images attached to unpublished property listings when such listings and images are present.",
  "mitigation": "Upgrade Essential Real Estate to version 5.3.5 or later.",
  "vendor": null,
  "product": "Essential Real Estate",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.3.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.3.5"
      ],
      "package_name": "Essential Real Estate",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.36491425,
  "t0_at": "2026-11-05T06:00:27.149000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T08:01:40.150163+00:00",
      "days": 0.08417825420138889,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:27.149000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T06:00:27.149000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:27.149000+00:00",
      "url": "https://github.com/advisories/GHSA-rvw5-rgwc-mcpp"
    }
  }
}