Security Alert Summary
The Easy Property Listings plugin before 3.5.28 exposes certain listing fields in the public REST API output without proper restrictions. This allows unauthenticated users to read listing details a site has chosen to hide on published listings, including asking price, sold price, street address, and exact map coordinates.
CVE Details
- CVE ID:
CVE-2026-96902 - Affected component: Easy Property Listings WordPress plugin
- Affected versions: versions before 3.5.28
- Published: October 20, 2026 at 6:16:58 AM UTC
- Last modified: October 20, 2026 at 4:17:19 PM UTC
- CVSS v3.1: Base score 5.3 (MEDIUM); Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N).
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness: CWE-200 (Exposure of Sensitive Information)
Technical Details
According to the advisory, Easy Property Listings prior to 3.5.28 fails to restrict which listing fields are added to the public REST API output. As a result, unauthenticated requests to the public API can receive fields the site intended to hide on published listings. Examples of exposed fields include the asking price, sold price, street address, and exact map coordinates.
The issue is a lack of access restriction on fields included in the public REST responses rather than an authentication bypass or privilege escalation. The vulnerability exists because the plugin adds sensitive listing data to responses available via the public REST API without appropriate checks to determine whether those fields should be omitted for unauthenticated or low-privilege users.
How This Could Impact Your Website
On a site using Easy Property Listings, a typical scenario might involve a site owner who configures listings to hide certain details, internal staff who manage content and believe those fields are private, and an external contractor or contributor who accesses the site for maintenance. Because the public REST API can return hidden fields, unauthenticated third parties could access sensitive listing details without interacting with site accounts.
Practical consequences include disclosure of pricing information and precise locations that were intended to remain private, which can increase the risk of targeted marketing or social engineering against staff or listed contacts. The exposure of listing details can also undermine buyer privacy expectations and site policies.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that can add or manage listings.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and logs for unusual API requests or unexpected data exposure.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
