← Database

CVE-2024-4274

MEDIUM CVSS: 4.3 Published: 2024-06-04 Modified: 2026-06-17

Description

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments.

Affected Platforms

G5Plus Essential Real Estate

Weakness Type

CWE-639, NVD-CWE-noinfo

References