CVE-2026-110964
Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
Description
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Essential Real Estate | 4.4.3 to <5.3.5 |
References
External links from the record. They lead to third-party sites.