CVE-2026-96902: Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Easy Property Listingsto a version that resolves this vulnerability.Fixed in 3.5.28
Event History
Frequently Asked Questions
Who can access the exposed listing details?
Any unauthenticated user can read the affected fields through the public REST API when they are present on published listings. No login or other privileges are required.
Which information may be disclosed?
Fields that the site intended to hide may be returned in REST API output, including asking price, sold price, street address, and exact map coordinates.
Which listings are affected?
The disclosure applies to published listings. The provided information does not indicate that unpublished, draft, or private listings are exposed.
What versions require remediation?
Easy Property Listings versions before 3.5.28 are affected. Updating to version 3.5.28 or later addresses the described issue.