WordPress Plugin Vulnerabilities

Essential Real Estate <= 5.2.2 - Authenticated (ERE Customer+) Insecure Direct Object Reference

Description

The Essential Real Estate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.2 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Custom-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
essential-real-estate
No known fix

References

CVE
CVE-2025-68071
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/acba11a8-6313-4043-9ffd-6208228a7e7c

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
0c8417bb-1ae8-4ef0-bce0-81afc524ab7d

Timeline

Publicly Published
2025-12-14 (about 9 months ago)
Added
2025-12-19 (about 9 months ago)
Last Updated
2025-12-19 (about 9 months ago)

Other

Published
Title
Published
2026-01-24
Title
Job Portal < 2.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-08-05
Title
CubeWP Framework <= 1.1.31 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
Published
2026-06-22
Title
WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR
Published
2026-07-28
Title
Formidable Forms Signature Online Contract Automation < 2.0.2 - Unauthenticated Insecure Direct Object Reference
Published
2026-01-01
Title
Branda – White Label & Branding, Free Login Page Customizer < 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover