CVE-2026-123670 Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning

The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with...

CVE-2026-123670

The Essential Real Estate WordPress plugin, in versions prior to 5.3.6 , is vulnerable to an email relay allowlist poisoning flaw. The software fails to verify the legitimacy of recipients for its contact email action. This allows users with the self-registered Customer role to add arbitrary addr...

WordPress Essential Real Estate plugin 5.3.5-5.3.5 - Customer+ Email Relay Allowlist Poisoning vulnerability

Customer+ Email Relay Allowlist Poisoning vulnerability discovered by Aabideen Bangash in WordPress Plugin Essential Real Estate versions 5.3.5-5.3.5...