CVE-2026-96902— Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
Quick assessment
Affected
Unknown Easy Property Listings
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 3.5.28 版本之前的 Easy Property Listings WordPress 插件未限制添加到公开 REST API 输出中的房源字段，这使得未认证用户可以读取站点在已发布房源中选择隐藏的信息，例如要价、成交价、街道地址以及精确的地图坐标。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96902
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Easy Property Listings | 0 ~ 3.5.28 | - |
|
II. Public POCs for CVE-2026-96902
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96902
请登录查看更多情报信息。
Other References for CVE-2026-96902 (1)
-
https://wpscan.com/vulnerability/b89e410b-982d-44e0-850d-8325a51db365/ exploit vdb-entry technical-description
IV. Related Vulnerabilities
Same product: Easy Property Listings
-
CVE-2026-96903
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data -
CVE-2026-16684
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber -
CVE-2025-68072
WordPress Easy Property Listings plugin <= 3.5.20 - Broken A -
CVE-2025-64242
WordPress Easy Property Listings plugin <= 3.5.22 - Broken A -
CVE-2024-2869
Easy Property Listings <= 3.5.3 - Admin+ Stored XSS
Same vendor: Unknown
-
CVE-2026-96903
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data -
CVE-2026-94294
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and -
CVE-2026-94231
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94272
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Orde -
CVE-2026-94230
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat
V. Comments for CVE-2026-96902
No comments yet