What is the CVSS score of CVE-2026-32465?

CVE-2026-32465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Essential Real Estate are affected by CVE-2026-32465?

The Essential Real Estate WordPress plugin (versions 5.3.3 and earlier) contains an object injection flaw exploitable by any authenticated user to achieve remote code execution.

How to fix or mitigate CVE-2026-32465?

Within 24 hours, inventory all WordPress installations to identify if the Essential Real Estate by g5theme plugin (any version ≤5.3.3) is present and assess the criticality of real estate functionality for your business. Within 7 days, either disable and remove the plugin if feasible or begin evaluating alternative real estate plugins for migration planning. Within 30 days, complete migration to a replacement plugin, uninstall the vulnerable version entirely, and conduct comprehensive end-to-end testing of all real estate features in production environments.

Essential Real Estate CVE-2026-32465

EUVD-2026-60901 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-667w-p3xr-xc83

PHP WordPress Deserialization Essential Real Estate Wordpress Plugin G5Theme

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L reflects mandatory low-privilege account; AC:L reflects that WordPress multi-plugin environments routinely supply viable POP gadget chains.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 14:22 vuln.today

CVE Published

Aug 18, 2026 - 13:59 cve.org

HIGH 8.8

DescriptionCVE.org

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

AnalysisAI

PHP Object Injection in the Essential Real Estate WordPress plugin (≤ 5.3.3) by g5theme allows low-privileged authenticated users to pass a crafted serialized PHP object through a vulnerable unserialize() call, potentially triggering arbitrary code execution if a usable POP (Property-Oriented Programming) gadget chain exists within the WordPress installation. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact - realistic in WordPress environments where co-installed plugins routinely supply gadget chains. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) covers flaws where attacker-controlled input reaches PHP's native unserialize() function without sanitization. PHP's object model allows magic methods (__wakeup, __destruct, __toString, __get, etc.) to execute automatically upon deserialization, enabling an attacker-crafted object to chain method calls across the class hierarchy - a POP chain - ultimately achieving arbitrary file writes, deletion, or remote code execution. The affected product is the Essential Real Estate plugin by g5theme (CPE: cpe:2.3:a:g5theme:essential_real_estate:*:*:*:*:*:*:*:*) for WordPress, all versions through 5.3.3. WordPress's plugin architecture means that gadget chain candidates frequently exist across the broader plugin ecosystem installed alongside the vulnerable component, compounding the exploitability.

RemediationAI

Update the Essential Real Estate plugin to the latest version available in the WordPress plugin repository, which should contain the fix for this deserialization flaw - the exact patched release version was not confirmed in the available reference data, so verify the current version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/essential-real-estate/vulnerability/wordpress-essential-real-estate-plugin-5-3-3-php-object-injection-vulnerability before deploying. If an immediate update is not possible, disable user registration on the WordPress site to remove the low-privilege account attack surface; note this will block legitimate subscriber sign-ups as a trade-off. As a secondary compensating control, deploy a WAF rule targeting serialized PHP object patterns (e.g., 'O:[0-9]+:') in request bodies and query strings, though this may produce false positives on legitimate serialized data used elsewhere. Restricting network access to the WordPress admin and plugin endpoints to trusted IP ranges reduces exposure but does not eliminate it if the vulnerable endpoint is accessible to registered users.