CVE-2026-90966

Name of the Vulnerable Software and Affected Versions Essential Real Estate versions prior to 5.3.5

Description An issue exists where the plugin fails to verify if a listing package selected for free activation is actually free or if the requesting user is entitled to it. This is caused by a missing capability check on a function, allowing authenticated users with customer-level access and above to activate paid packages without payment, resulting in the site recording a paid invoice at the full price.

Recommendations Update to version 5.3.5 or later.