CVE-2023-6140 is a high severity (CVSS 8.8) unrestricted file upload flaw in the Essential Real Estate WordPress plugin before 4.4.0. Users with limited privileges, such as subscribers, can briefly upload PHP files disguised as ZIP archives, which may lead to remote code execution. Update to 4.4.0 or later.
What's affected
- Plugin: Essential Real Estate for WordPress, by G5Plus.
- Affected: versions before 4.4.0.
- Fixed: 4.4.0, per the NVD record and WPScan.
- Severity: 8.8 High in the NVD record.
- Privilege needed: a registered account, such as a subscriber, according to WPScan. Sites with open registration are the most exposed.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Essential Real Estate. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Essential Real Estate and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is usually essential-real-estate.
A version below 4.4.0 is affected. Check whether your site allows anyone to register, and what role new users get. Real estate sites often let visitors create accounts to save listings, so this is common.
What to do now
- Update Essential Real Estate to 4.4.0 or later.
- Search the uploads folder and plugin folders for script files that do not belong, such as files ending in .php.
- Review the user list for accounts you do not recognize, especially recent subscribers.
- Disable PHP execution in the uploads directory at the web server level.
- Close open registration, or require approval, if you do not need public accounts.
Why it matters
The plugin accepts a ZIP upload from a user with very little privilege, and the record says it does not stop a PHP file from passing as an archive. The record lists CWE-434, unrestricted upload of a file with a dangerous type. WPScan notes the file exists on the server for a moment, which can be enough for a request to reach it before the plugin removes it.
The low bar for access is what raises the score. Many sites let anyone sign up, so the attacker's cost is one throwaway account. Remote code execution then gives access to the database, other sites on the same account and stored credentials. WPScan's page includes a working proof of concept, so assume attackers can reproduce it. The record does not list this CVE as known exploited. A server rule that blocks script execution in uploads limits the damage of any upload bug.
Quick check
The file is only there for a moment. Is that safe?
No. A short window is enough for a determined request, and the sources describe code execution as the possible result. Update and block script execution in uploads.
Sources
Last reviewed: 19 October 2026.
