CVE-2026-96902 in Easy Property Listings Plugin
Summary
by MITRE • 10/20/2026
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Easy Property Listings versions prior to 3.5.28 represents a significant information disclosure flaw rooted in improper access control mechanisms within the plugin's integration with the WordPress REST API. The core technical issue lies in the failure of the application logic to validate user permissions before exposing sensitive property data through public endpoints. Specifically, while the frontend interface of the website may restrict certain fields such as asking price, sold price, street address, and precise geographic coordinates from being visible to general visitors or unauthenticated users, the underlying REST API endpoint does not enforce these same restrictions. This discrepancy creates a direct path for attackers to bypass intended visibility settings by querying the API directly with standard HTTP requests that do not require authentication credentials.
From an operational perspective, this flaw allows any individual on the internet to retrieve detailed information about properties listed through the plugin without needing valid login credentials or specific user roles. The impact extends beyond simple data leakage; it compromises the privacy of property owners who may have intentionally withheld sensitive details for security or business reasons. For real estate professionals and agencies using this platform, the exposure of exact map coordinates can pose physical safety risks to homeowners, while the disclosure of asking prices and sold history undermines competitive positioning and negotiation leverage. Furthermore, aggregated data from multiple listings could be scraped by malicious actors to build comprehensive databases for targeted phishing campaigns or social engineering attacks that rely on accurate personal and financial information.
This vulnerability aligns with CWE-200, which categorizes Information Exposure as a class of weaknesses where sensitive information is disclosed without proper authorization. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques under the Discovery tactic, specifically API Abuse or Data from Configuration Repository, depending on how the attacker enumerates and extracts the data. The lack of server-side validation for REST API responses means that client-side visibility toggles are ineffective as a security control, highlighting a common architectural flaw where frontend logic is trusted implicitly over backend enforcement mechanisms.
To mitigate this risk, administrators must upgrade to version 3.5.28 or later of the Easy Property Listings plugin, which addresses these permission checks within the REST API handlers. Until an update can be applied, temporary mitigations include restricting access to the WordPress REST API via web application firewall rules that block unauthenticated requests to specific endpoints associated with property data retrieval. Additionally, implementing strict rate limiting on API calls can help reduce the effectiveness of automated scraping tools attempting to harvest large volumes of sensitive information. Regular security audits should also be conducted to ensure that all custom plugins and themes adhere to the principle of least privilege when exposing data through public interfaces.