CVE-2023-6139: essential real — Exploit

Description

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.

Is your site exposed to CVE-2023-6139?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
g5plus	essential_real_estate	< 4.4.0

References

Exploits

https://wpscan.com/vulnerability/96396a22-f523-4c51-8b72-52be266988aa https://wpscan.com/vulnerability/96396a22-f523-4c51-8b72-52be266988aa

Frequently Asked Questions

What is CVE-2023-6139? +

The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2023-6139? +

CVE-2023-6139 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2023-6139? +

CVE-2023-6139 affects products from g5plus, specifically: essential_real_estate. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-6139? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-24797 9.8

Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed …

CVE-2024-13545 9.8

The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 …

CVE-2023-6140 8.8

The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, …

CVE-2024-13418 8.8

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the …

CVE-2024-37462 8.5

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows …

CVE-2025-30849 8.1

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate …

CVE-2023-6139