Description
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Essential Real Estate | 4.4.3 – < 5.3.5 | 5.3.5 |
References
- https://wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/ exploit vdb-entry technical-description