{"affected":[{"defaultStatus":"unaffected","product":"Essential Real Estate","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.5","status":"affected","version":"4.4.3","versionType":"semver"}]}],"cveId":"CVE-2026-110964","cwes":["CWE-639"],"description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/"}],"kev":null,"metrics":[],"modifiedAt":1793772025396,"publishedAt":1793772025396,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/"}],"remediation":[],"revision":"e029f98092a68d05e736cc4e369e78ab75ef311ec9bc941e724f2b8ec9fdcd25","sources":[{"modifiedAt":1793772025396,"name":"CNA: WPScan","retrievedAt":1793776123385,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110964"}],"ssvc":null,"status":"published","title":"Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR","updatedAt":1793776123385}