UNKNOWN NVD

CVE-2026-110964

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a se

The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

References

https://wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/

Published: 2026-11-04 · Source: NVD · Feed updated: 2026-11-04

This unknown severity vulnerability was published on 2026-11-04 via NVD.

vulnfeed aggregates 18348 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.