Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Essential Real Estate | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 05 Nov 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-285 |
Thu, 05 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price. | |
| Title | Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-05T06:00:27.333Z
Reserved: 2026-09-14T13:25:36.414Z
Link: CVE-2026-90966
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-05T06:17:10.087
Modified: 2026-11-05T15:06:27.350
Link: CVE-2026-90966
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-05T07:45:14Z