CVE-2023-6139

Essential Real Estate < 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.

Affected

Essential Real Estate

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.61% chance of exploitation in the next 30 days, 48th percentile

Published

2024-01-08

Updated

2025-06-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/96396a22-f523-4c51-8b72-52be266988aa

References

• CVE Record
• NVD entry