CVE-2026-17515 — MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

CVE-2026-17515

MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item PUBLISHED

Description (CNA)

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.

Affected (CNA)

Vendor / product	Versions
Unknown / MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings	affected 0 before 7.0.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-ca924a60f909/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.