Security Alert Summary
The Easy Property Listings WordPress plugin before version 3.5.27 has an authorization issue in several contact-management read AJAX actions. This allows any authenticated user with a role as low as subscriber to read other users’ CRM contact and lead records, including private activity notes.
CVE Details
- CVE ID: CVE-2026-96903
- Affected component: Easy Property Listings WordPress plugin
- Affected versions: Versions before 3.5.27
- Published: October 20, 2026 at 6:16:58 AM UTC
- Last modified: October 20, 2026 at 4:17:19 PM UTC
- CVSS v3.1: Base score 4.3, Medium —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: Requires an authenticated user with low privileges (PR:L). No user interaction required (UI:N).
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / weakness ID: CWE-200 (Information Exposure)
Technical Details
According to the advisory, several contact-management read AJAX actions in the plugin do not perform authorization checks. Because these endpoints lack proper permission checks, any authenticated user, including those with the subscriber role, can access other users’ CRM contact and lead records. The exposed data can include private activity notes associated with those records.
The issue is an authorization bypass on read operations delivered via AJAX endpoints. The CVE description does not name specific function names or REST endpoints, so no endpoint names are referenced here. The root cause is missing or insufficient server-side authorization checks on contact-management read handlers, allowing data disclosure to low-privileged accounts.
Impact is limited to disclosure of data accessible through those endpoints. There is no indication in the provided data of direct ability to modify records or affect availability.
How This Could Impact Your Website
On a site using Easy Property Listings, a realistic scenario could involve a subscriber or an external contributor who has a basic authenticated account. Because the affected AJAX actions permit read access without proper authorization, that user could retrieve CRM contacts and leads entered by other staff, including private notes about interactions or negotiations.
Practical consequences include exposure of internal user email addresses and contact details, which increases the risk of targeted phishing or social engineering against staff and contractors. For example, a contractor with a low-privilege account could enumerate contact records and use private notes to craft convincing messages aimed at finance or operations staff.
If youâre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts that do not require access to CRM data.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected AJAX requests or bulk reads of contact endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
