The identified issue involves an Authorization Bypass through User‑Controlled Key in the g5theme Essential Real Estate WordPress plugin. An attacker can supply a crafted key to plugin endpoints, causing the system to skip normal access checks and permitting the attacker to read or modify protected listing data. This can compromise the confidentiality and integrity of real‑estate listings, and is inferred to be exploitable via crafted HTTP requests that include a request‑parameter key or identifier.

The vulnerable product is the g5theme Essential Real Estate WordPress plugin. All released versions from the first iteration through version 5.3.2 are affected. No later releases are documented as vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to guess or obtain a valid key to bypass normal authorization, allowing unauthorized read/write operations on listing data, which could be significant for sites that rely on the plugin for confidential listings.