← CVE index
Vulnerability record/PUBLISHED/Published Nov 4, 2026 06:00:25 UTC

CVE-2026-110964

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

Base score6.5/ 10
SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactNoneA
CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityWPScan
Last updatedNov 4, 2026 14:18:22 UTC
PublishedNov 4, 2026 06:00:25 UTC
ReservedOct 15, 2026 09:49:26 UTC

Credits

  • sungbyeongchan
  • WPScan