Quick answers
- Is CVE-2026-32465 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32465 being exploited in the wild.
- How severe is CVE-2026-32465?
- High severity, with a CVSS score of 8.8, published 18 August 2026.
- Which products and versions are affected?
- Essential Real Estate <=5.3.3.
- Is there a fix for CVE-2026-32465?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-32465 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-32465?
- Check whether you run Essential Real Estate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP Object Injection flaw in the Essential Real Estate WordPress plugin versions 5.3.3 and earlier. An authenticated customer-level user can exploit this vulnerability by manipulating serialized data processed by the plugin, triggering unserialization of malicious PHP objects. This allows remote code execution on the server with the privileges of the web application. The attack requires valid customer credentials but does not require administrative access. As of the advisory date, no official patch is available, though Patchstack has released a mitigation rule to block exploitation attempts.
Affected products
- Essential Real Estate Essential Real Estate <=5.3.3
Timeline
- 2026-08-18: disclosed
- 2026-01-19: reported: Initial report by Steven Julian