Live › vulnerability › CVE-2026-96902
Go to dashboardThe Easy Property Listings WordPress plugin before 3.5.28 adds listing fields to its public REST API output without checking which fields the site has chosen to hide. An unauthenticated visitor can read hidden details such as asking price, sold price, street address and exact map coordinates from published listings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Easy Property Listings plugin before 3.5.28 that publish property listings and hide some fields, such as sold price or exact address, from the public page. Sites that show every field publicly, or that do not use this plugin, are not exposed by this issue.
No product ranges from the sources yet.
wp plugin get easy-property-listings --field=version if WP-CLI is available.3.5.28 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
This page as .md · .json · in your agent: get_signal("CVE-2026-96902")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.