{"id":"CVE-2026-96903","kind":"vulnerability","aliases":["CVE-2026-96903"],"related":[],"title":"Easy Property Listings WordPress plugin: subscribers can read other users' CRM records","description":"The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.","summary":"The Easy Property Listings WordPress plugin before 3.5.27 has AJAX actions for contact management that skip authorisation checks. Any logged-in user, even a subscriber, can read other users' CRM contact and lead records, including private activity notes.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","real-estate-sites","wordpress"],"not_affected_if":["plugin-not-installed","registration-closed","version-3.5.27-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins or in `wp-content/plugins/easy-property-listings/` and see whether it is below `3.5.27`\n- Review the site's user list for subscriber-level accounts that can register or log in, since those accounts are the attack entry point","fix":"- Update Easy Property Listings to `3.5.27` or later\n- Until updated, restrict or disable open user registration so only trusted accounts can log in","status":"open","published_at":"2026-10-20T06:16:58+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:39:27+00:00","updated_at":"2026-10-25T04:39:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:39:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update Easy Property Listings to `3.5.27` or later\n- Until updated, restrict or disable open user registration so only trusted accounts can log in","reach":"internet","title":"Easy Property Listings WordPress plugin: subscribers can read other users' CRM records","impact":"medium","summary":"The Easy Property Listings WordPress plugin before 3.5.27 has AJAX actions for contact management that skip authorisation checks. Any logged-in user, even a subscriber, can read other users' CRM contact and lead records, including private activity notes.","category":"package","nicknames":[],"who_cares":["wordpress","real-estate-sites","crm"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any logged-in user reads other users' CRM contacts and private notes","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins or in `wp-content/plugins/easy-property-listings/` and see whether it is below `3.5.27`\n- Review the site's user list for subscriber-level accounts that can register or log in, since those accounts are the attack entry point","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.5.27-or-later","registration-closed"],"who_is_affected":"Sites running the Easy Property Listings plugin before 3.5.27 that allow logins by any role, including subscriber, are exposed. Sites where only trusted staff hold accounts, or where registration is closed, face much less risk. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000615,"input_tokens":3311,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-96903':15A,18A '3.5.27':33B,72C 'action':36B,87C 'activ':63B,111C 'ajax':35B,86C 'allow':88C 'authent':90C 'authoris':42B,76C 'check':43B,77C 'contact':38B,57B,83C,104C 'contact-manag':82C 'crm':11A,19B,56B,103C 'cve':13A,16A 'easi':1A,27B,66C 'estat':23B 'even':49B 'includ':61B,108C 'lead':59B,106C 'list':3A,29B,68C 'log':46B 'logged-in':45B 'low':96C 'manag':39B,84C 'note':64B,112C 'packag':20B 'perform':75C 'plugin':5A,31B,70C 'privat':62B,110C 'properti':2A,28B,67C 'read':8A,53B,85C,100C 'real':22B 'real-estate-sit':21B 'record':12A,60B,107C 'role':94C 'sever':79C 'site':24B 'skip':41B 'subscrib':6A,51B,98C 'user':10A,48B,55B,91C,102C 'wordpress':4A,25B,30B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Easy Property Listings plugin before 3.5.27 that allow logins by any role, including subscriber, are exposed. Sites where only trusted staff hold accounts, or where registration is closed, face much less risk. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T06:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96903","severity":null,"published_at":"2026-10-20T06:16:58+00:00","modified_at":"2026-10-20T19:29:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}