Is CVE-2026-54827 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54827 being exploited in the wild.

How severe is CVE-2026-54827?

Critical severity, with a CVSS score of 9.3, published 26 June 2026.

Which products and versions are affected?

Contempo Inc. Real Estate 7 <= 3.5.9.

Is there a fix for CVE-2026-54827?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54827 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54827?

Check whether you run Contempo Inc. Real Estate 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54827: contempoinc Real Estate 7 SQL injection

Q: Is there a fix for CVE-2026-54827?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-54827 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-54827?

Check whether you run Contempo Inc. Real Estate 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54827 · Severity: critical · CVSS 9.3 · Published 2026-06-26

The Real Estate 7 theme for WordPress, which is used to build property listing and real estate websites, contains a critical security flaw. An unauthenticated attacker can exploit this vulnerability to interact directly with the website's database. This could lead to the theft of sensitive customer information, unauthorized access to site data, or disruption of business operations.

Technologies: Contempo Inc. Real Estate 7. Vendors: Contempo Inc..

Quick answers

Is CVE-2026-54827 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54827 being exploited in the wild.
How severe is CVE-2026-54827?: Critical severity, with a CVSS score of 9.3, published 26 June 2026.
Which products and versions are affected?: Contempo Inc. Real Estate 7 <= 3.5.9.
Is there a fix for CVE-2026-54827?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54827 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54827?: Check whether you run Contempo Inc. Real Estate 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the Real Estate 7 WordPress theme (versions <= 3.5.9) due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is accessible to unauthenticated remote attackers via the network without any user interaction. Successful exploitation allows an attacker to bypass authentication, extract sensitive data from the database, or potentially modify database records. The vulnerability has been addressed in version 3.6.0.

Affected products

contempoinc Real Estate 7 <= 3.5.9

Timeline

2026-04-30: other: Reported by João Pedro S Alcântara (Kinorth)
2026-06-17: advisory: Patchstack advisory published
2026-06-26: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.