{"id":"CVE-2026-110964","published":"2026-11-04T06:16:58.480","lastModified":"2026-11-04T06:16:58.480","description":"The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/2c79fd6f-56ca-4133-ac6c-84b2d15c0fa4/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}