CVE-2026-96902
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Risk Assessment
This may lead to disclosure of sensitive property information, potentially compromising privacy and data security.
Recommendation
It is recommended to update the plugin to version 3.5.28 or later.
Other vulnerabilities in Easy Property Listings WordPress plugin
Original NVD description (English source)
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS