CVE-2026-96903
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Risk Assessment
This may lead to unauthorized access to sensitive CRM data, violating privacy and potentially leading to leakage of business information.
Recommendation
It is recommended to update the plugin to version 3.5.27 or later.
Other vulnerabilities in Easy Property Listings WordPress plugin
Original NVD description (English source)
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS