Vulnerability · Published Oct 20, 2026 · Assigned by WPScan
CVE-2026-96902Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
Medium 5.3
In plain English
A medium-severity information exposure in Easy Property Listings from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Easy Property Listings | 0 – before 3.5.28 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/b89e410b-982d-44e0-850d-8325a51db365/ exploit, vdb-entry, technical-description