CVE-2025-64242
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.
Risk Assessment
An attacker could exploit missing authorization to access functions or data without proper permissions, potentially leading to integrity and confidentiality breaches.
Recommendation
Update the Easy Property Listings plugin to the latest patched version. Review and fix access control configurations and restrict access to sensitive functions.
Other vulnerabilities in Easy Property Listings
See all- CVE-2026-61989High
The Easy Property Listings WordPress plugin in versions up to 3.5.25 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script that executes in the user's browser.
- CVE-2026-16684Medium
The Easy Property Listings plugin for WordPress up to version 3.5.24 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'facebook' user contact method. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS