CVE-2026-110964
Received Received - Intake

Unauthorized Media Deletion in Essential Real Estate WordPress Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WPScan

Description
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-110964
EUVD
EUVD-2026-116719

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Essential Real Estate 4.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Essential Real Estate WordPress plugin versions 4.4.3 to 5.3.4. It allows authenticated users with subscriber-level access or higher to delete media attachments from other users' libraries, including those owned by administrators, due to a lack of ownership verification before processing deletion requests.

Detection Guidance

Check WordPress plugin versions for Essential Real Estate plugin. Run: wp plugin list --name=essential-real-estate. If version is between 4.4.3 and 5.3.4, the system is vulnerable. Also review media library permissions and audit logs for unauthorized deletion attempts.

Impact Analysis

An attacker could exploit this to delete important media files, including those owned by administrators, potentially causing data loss or disrupting website functionality. Self-registered users with basic access could target sensitive attachments.

Mitigation Strategies

Update the Essential Real Estate plugin to version 5.3.5 or later immediately. Remove or disable subscriber-level access if not required. Monitor media library for unauthorized deletions and restrict user roles to minimum necessary permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...