CVE-2026-90966

MediumCVSS 4.3/10Last modified Nov 6, 2026

Description

The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-909674.3The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actio CVE-2026-909696.5Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking CVE-2026-90979.8Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function CVE-2026-909709.9GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4,CVE-2026-909716.5Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged CVE-2026-909725.4The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authe CVE-2026-909746.5The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initializati CVE-2026-909757.8A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interfa CVE-2026-909765.3The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registrat CVE-2026-909775.3The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unaut CVE-2026-909787.1The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, CVE-2026-909797.3LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn