---
id: "CVE-2026-96902"
kind: "vulnerability"
aliases: ["CVE-2026-96902"]
title: "WordPress Easy Property Listings plugin leaks hidden listing fields via REST API"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "real-estate-sites", "self-hosted", "wordpress"]
not_affected_if: ["no-hidden-listing-fields", "plugin-3.5.28-or-later"]
published_at: "2026-10-20T06:16:58+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96902", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# WordPress Easy Property Listings plugin leaks hidden listing fields via REST API

The Easy Property Listings WordPress plugin before 3.5.28 adds listing fields to its public REST API output without checking which fields the site has chosen to hide. An unauthenticated visitor can read hidden details such as asking price, sold price, street address and exact map coordinates from published listings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get easy-property-listings --field=version` if WP-CLI is available.
- Request the plugin's REST routes while logged out and look for price or address fields that the site hides on the listing page.

## Fix

- Update the Easy Property Listings plugin to `3.5.28` or later.
- Until the update is applied, restrict or hide the plugin's REST API output if the host allows it.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96902

## From the sources

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_