{"affected":[{"defaultStatus":"unaffected","product":"Essential Real Estate","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.5","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-90965","cwes":["CWE-284"],"description":"The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d/"}],"kev":null,"metrics":[],"modifiedAt":1793858427149,"publishedAt":1793858427149,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d53035c9-0f84-4c86-8c0e-fe2bca2d0a4d/"}],"remediation":[],"revision":"545e4b690ba775df6ef9094b0b56ac94d16f5b731594a16f18a6929e8d0a28dc","sources":[{"modifiedAt":1793858427149,"name":"CNA: WPScan","retrievedAt":1793859024174,"url":"https://www.cve.org/CVERecord?id=CVE-2026-90965"}],"ssvc":null,"status":"published","title":"Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure","updatedAt":1793859024174}