What’s Vulnerable › Vulnerabilities

CVE-2024-13318: Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-10 · updated 2026-06-17
• Weakness: CWE-463

Description

The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.

Affected products

• smartdatasoft Essential WP Real Estate: through 1.1.3

References

• https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve

Get alerted when CVE-2024-13318 or the next vulnerability affects your stack