Description
The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Essential Real Estate | 5.3.5 – < 5.3.6 | 5.3.6 |
References
- https://wpscan.com/vulnerability/04d772fe-001d-4f25-a11a-dedf16064ce4/ exploit vdb-entry technical-description