PT-2026-52729 · Contempoinc+1 · Real Estate 7

João Pedro S Alcântara + 1 · CVE-2026-54827 · Published 2026-06-17 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Real Estate 7 versions prior to 3.6.0

Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update Real Estate 7 to a version newer than 3.5.9.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-54827

Affected Products

Real Estate 7

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54827 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3debeffa-5cc3-4d13-aed8-72753a62d8fc?source=api-prod · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54827 · Note
• https://patchstack.com/database/wordpress/theme/realestate-7/vulnerability/wordpress-real-estate-7-theme-3-5-9-sql-injection-vulnerability?_s_id=cve · Note