CVE-2026-32465

HighCVSS 8.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The Essential Real Estate plugin versions up to 5.3.3 contain a Customer PHP Object Injection vulnerability. An attacker can inject malicious PHP objects, which could lead to remote code execution.

Risk Assessment

The risk includes the possibility of remote code execution on the server, which could lead to full site takeover and data security compromise.

Recommendation

It is recommended to update the Essential Real Estate plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.