{"id":"CVE-2026-96902","kind":"vulnerability","aliases":["CVE-2026-96902"],"related":[],"title":"WordPress Easy Property Listings plugin leaks hidden listing fields via REST API","description":"The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.","summary":"The Easy Property Listings WordPress plugin before 3.5.28 adds listing fields to its public REST API output without checking which fields the site has chosen to hide. An unauthenticated visitor can read hidden details such as asking price, sold price, street address and exact map coordinates from published listings.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","real-estate-sites","self-hosted","wordpress"],"not_affected_if":["no-hidden-listing-fields","plugin-3.5.28-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get easy-property-listings --field=version` if WP-CLI is available.\n- Request the plugin's REST routes while logged out and look for price or address fields that the site hides on the listing page.","fix":"- Update the Easy Property Listings plugin to `3.5.28` or later.\n- Until the update is applied, restrict or hide the plugin's REST API output if the host allows it.","status":"open","published_at":"2026-10-20T06:16:58+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:58+00:00","updated_at":"2026-10-25T04:24:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Easy Property Listings plugin to `3.5.28` or later.\n- Until the update is applied, restrict or hide the plugin's REST API output if the host allows it.","reach":"internet","title":"WordPress Easy Property Listings plugin leaks hidden listing fields via REST API","impact":"low","summary":"The Easy Property Listings WordPress plugin before 3.5.28 adds listing fields to its public REST API output without checking which fields the site has chosen to hide. An unauthenticated visitor can read hidden details such as asking price, sold price, street address and exact map coordinates from published listings.","category":"package","nicknames":[],"who_cares":["wordpress","real-estate-sites","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Hidden sale prices and exact addresses readable by anyone","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get easy-property-listings --field=version` if WP-CLI is available.\n- Request the plugin's REST routes while logged out and look for price or address fields that the site hides on the listing page.","needs_analyst":false,"not_affected_if":["plugin-3.5.28-or-later","no-hidden-listing-fields"],"who_is_affected":"Sites running the Easy Property Listings plugin before 3.5.28 that publish property listings and hide some fields, such as sold price or exact address, from the public page. Sites that show every field publicly, or that do not use this plugin, are not exposed by this issue.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3314,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96902':15A,18A '3.5.28':35B,84C 'add':36B,92C 'address':69B,122C 'allow':99C 'api':12A,43B,97C 'ask':64B,117C 'check':46B 'chosen':52B,108C 'coordin':73B,126C 'cve':13A,16A 'detail':61B,104C 'easi':2A,29B,78C 'estat':22B 'exact':71B,124C 'field':9A,38B,48B,90C 'hidden':7A,60B 'hide':54B,110C 'host':26B 'leak':6A 'list':4A,8A,31B,37B,76B,80C,89C,113C 'map':72B,125C 'output':44B,98C 'packag':19B 'plugin':5A,33B,82C 'price':65B,67B,118C,120C 'properti':3A,30B,79C 'public':41B,95C 'publish':75B,112C 'read':59B,103C 'real':21B 'real-estate-sit':20B 'rest':11A,42B,96C 'restrict':87C 'self':25B 'self-host':24B 'site':23B,50B,106C 'sold':66B,119C 'street':68B,121C 'unauthent':56B,100C 'user':101C 'via':10A 'visitor':57B 'without':45B 'wordpress':1A,27B,32B,81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Easy Property Listings plugin before 3.5.28 that publish property listings and hide some fields, such as sold price or exact address, from the public page. Sites that show every field publicly, or that do not use this plugin, are not exposed by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T06:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96902","severity":null,"published_at":"2026-10-20T06:16:58+00:00","modified_at":"2026-10-20T19:29:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}