Vulnerability · Published Aug 5, 2026 · Assigned by WPScan

CVE-2026-17515MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

Medium 4.3

In plain English

A medium-severity information exposure in MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 94.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.

Affected products (as reported)

Vendor	Product	Versions
Unknown	MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings	0 – before 7.0.4

Weakness: CWE-200, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-ca924a60f909/ exploit, vdb-entry, technical-description