{"affected":[{"defaultStatus":"unaffected","product":"Essential Real Estate","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.5","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-90966","cwes":["CWE-862"],"description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/445a0351-d452-412e-8145-d427e10e0948/"}],"kev":null,"metrics":[],"modifiedAt":1793858427333,"publishedAt":1793858427333,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/445a0351-d452-412e-8145-d427e10e0948/"}],"remediation":[],"revision":"edac4063c228bac956c940ca57c1419966251ee2a60c777ac426da59fee07523","sources":[{"modifiedAt":1793858427333,"name":"CNA: WPScan","retrievedAt":1793859025573,"url":"https://www.cve.org/CVERecord?id=CVE-2026-90966"}],"ssvc":null,"status":"published","title":"Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax","updatedAt":1793859025573}