This vulnerability (CVE-2026-32465) affects Essential Real Estate versions up to 5.3.3 and is caused by unsafe deserialization of untrusted data leading to PHP Object Injection. The CVSS 3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability is publicly known and published but lacks an official remediation or patch at this time. There are no known exploits in the wild reported.

Successful exploitation could allow an attacker with low privileges to execute arbitrary PHP object injection attacks, potentially leading to full compromise of the application, including unauthorized data access, modification, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to vulnerable endpoints and monitoring for suspicious activity related to PHP object injection attempts.