{"api_version":"1","generated_at":"2026-11-05T11:42:24+00:00","cve":"CVE-2026-90964","urls":{"html":"https://cve.report/CVE-2026-90964","api":"https://cve.report/api/cve/CVE-2026-90964.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90964","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90964"},"summary":{"title":"Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-05 06:17:09","updated_at":"2026-11-05 06:17:09"},"problem_types":["CWE-284 Improper Access Control"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435/","name":"https://wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90964","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90964","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Essential Real Estate","version":"affected 5.3.5 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Artus KG","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Essential Real Estate","vendor":"Unknown","versions":[{"lessThan":"5.3.5","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Artus KG"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site."}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T06:00:26.961Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/851b3747-823c-4f38-a449-117acf4b6435/"}],"source":{"discovery":"EXTERNAL"},"title":"Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-90964","datePublished":"2026-11-05T06:00:26.961Z","dateReserved":"2026-09-14T13:25:22.561Z","dateUpdated":"2026-11-05T06:00:26.961Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-05 06:17:09","lastModifiedDate":"2026-11-05 06:17:09","problem_types":["CWE-284 Improper Access Control"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90964","Ordinal":"1","Title":"Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email ","CVE":"CVE-2026-90964","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90964","Ordinal":"1","NoteData":"The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.","Type":"Description","Title":"Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email "}]}}}