CVE-2026-96902
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 20, 2026
- Updated
- Oct 20, 2026
- Reserved
- Sep 23, 2026
Description
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
Easy Property ListingsUnknown |
|
References
- https://wpscan.com/vulnerability/b89e410b-982d-44e0-850d-8325a51db365/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.