CVE-2024-4274

—

CVSS 3.1

4.3 medium

EPSS

<1%p39

Published

Jun 4, 2024 (Jun 4, 2024)

Modified

Jun 17, 2026

Description

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.

Vendors: g5plus
Products: essential real estate
Ecosystems: WordPress
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.