CVE-2026-96903 — Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

CVE-2026-96903

Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers PUBLISHED

Description (CNA)

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

Affected (CNA)

Vendor / product	Versions
Unknown / Easy Property Listings	affected 0 before 3.5.27

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/52b63cac-2730-4395-bf68-3a55aceb0e14/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.