CVE-2026-96903— Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
Quick assessment
Affected
Unknown Easy Property Listings
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 3.5.27 版本之前的 Easy Property Listings WordPress 插件中，多个用于联系人管理的读取型 AJAX 操作未执行授权检查，导致任何已登录用户（即使其角色仅为订阅者）均可读取其他用户的 CRM 联系人和潜在客户记录，包括其私密的活动备注。
Possible ATT&CK Techniques 1 AI
T1086
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96903
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Easy Property Listings | 0 ~ 3.5.27 | - |
|
II. Public POCs for CVE-2026-96903
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96903
请登录查看更多情报信息。
Other References for CVE-2026-96903 (1)
-
https://wpscan.com/vulnerability/52b63cac-2730-4395-bf68-3a55aceb0e14/ exploit vdb-entry technical-description
IV. Related Vulnerabilities
Same product: Easy Property Listings
-
CVE-2026-96902
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Lis -
CVE-2026-16684
Easy Property Listings <= 3.5.24 - Authenticated (Subscriber -
CVE-2025-68072
WordPress Easy Property Listings plugin <= 3.5.20 - Broken A -
CVE-2025-64242
WordPress Easy Property Listings plugin <= 3.5.22 - Broken A -
CVE-2024-2869
Easy Property Listings <= 3.5.3 - Admin+ Stored XSS
Same vendor: Unknown
-
CVE-2026-96902
Easy Property Listings < 3.5.28 - Unauthenticated Hidden Lis -
CVE-2026-94294
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and -
CVE-2026-94231
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat -
CVE-2026-94272
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Orde -
CVE-2026-94230
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticat
V. Comments for CVE-2026-96903
No comments yet