PT-2026-52811

CVE-2026-57641

Published

2026-06-26

Updated

2026-10-25

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Real Estate 7 versions prior to 3.6.0

Description An unauthenticated Cross-Site Request Forgery (CSRF) issue exists in the Real Estate 7 WordPress theme. This occurs due to missing or incorrect nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user—within a function. This allows an attacker to perform unauthorized actions by tricking a site administrator into clicking a malicious link.

Recommendations Update to a version newer than 3.5.9.

Exploitability

Fix

Impacts

Researchers

João Pedro S Alcântara

Kinorth

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers