WordPress Plugin Vulnerabilities

Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR

Description

The plugin does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.

Proof of Concept

Affects Plugins

Plugin icon
essential-real-estate
Fixed in 5.3.5

References

CVE
CVE-2026-110964

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
sungbyeongchan
Submitter
sungbyeongchan
Verified
Yes
WPVDB ID
2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2026-08-18
Title
TrueBooker < 1.2.7 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Published
2026-11-02
Title
FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
Published
2023-01-27
Title
Quick Restaurant Menu < 2.1.0 - Subscriber+ Arbitrary Post Deletion/Updating
Published
2025-12-03
Title
HUSKY – Products Filter Professional for WooCommerce < 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Published
2026-08-10
Title
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR