{"affected":[{"defaultStatus":"unaffected","product":"Essential Real Estate","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"5.3.5","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-90967","cwes":["CWE-639"],"description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/745cf24b-2dbd-41ea-b26d-d1c6f0a25de9/"}],"kev":null,"metrics":[],"modifiedAt":1793858427515,"publishedAt":1793858427515,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/745cf24b-2dbd-41ea-b26d-d1c6f0a25de9/"}],"remediation":[],"revision":"2ed9ed8ef6bd7207a8fac409f4ae0d663648e6dc5a48abf70a129a0cc3e7b464","sources":[{"modifiedAt":1793858427515,"name":"CNA: WPScan","retrievedAt":1793859026686,"url":"https://www.cve.org/CVERecord?id=CVE-2026-90967"}],"ssvc":null,"status":"published","title":"Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR","updatedAt":1793859026686}