CVE-2026-96903: Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
Published Oct 20, 2026
·Updated
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Affected Software
1 affected component
Easy Property Listings Easy Property Listings<3.5.27
Event History
Oct 20, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated WordPress user with a role as low as Subscriber can exploit the affected contact-management AJAX read actions. An attacker does not need elevated WordPress privileges.
2
What information could an attacker access?
An attacker can read other users' CRM contact and lead records, including private activity notes.
3
Which deployments are affected?
Easy Property Listings versions before 3.5.27 are affected. The issue concerns several contact-management read AJAX actions that lack authorization checks.