[ CVE-2026-96902 · Published 20 Oct 2026 ]
Vulnerability in Unknown Easy Property Listings
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.