EUVD-2026-53122
GHSA-rrqj-x694-jg5v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-exploitable via AJAX but requires any authenticated WordPress account (PR:L); only log and metadata disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.
AnalysisAI
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Technical ContextAI
The affected product is a WordPress plugin providing MLS/IDX real estate listing import functionality (CPE: cpe:2.3:a:unknown:mlsimport:_idx_plugin_&_mls_plugin_for_real_estate_listings). WordPress plugins register AJAX handlers via wp_ajax_ hooks, which can be restricted by role or nonce. This plugin failed to apply either control to at least one AJAX action, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). As a result, the WordPress role-based capability system - which normally gates administrative operations behind checks like current_user_can() - is bypassed entirely for this action. The disclosed data includes the plugin's import log file and import-related metadata tied to arbitrary posts, which may reveal internal configuration details, data source paths, or third-party MLS API interactions.
RemediationAI
Update the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings plugin to version 7.0.4 or later via the WordPress dashboard or by downloading the patched release directly from the plugin repository - this is the only confirmed fix as documented by WPScan (https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-ca924a60f909/). As a temporary compensating control where immediate patching is not feasible, restrict WordPress user registration or set all non-admin accounts to require approval, reducing the pool of potential authenticated attackers; note this does not eliminate risk from already-registered subscriber-level accounts. Alternatively, use a WAF or security plugin (e.g., Wordfence) to block unauthenticated or low-privilege AJAX requests to the specific vulnerable action endpoint, though the exact action name should be confirmed from the plugin source before applying this rule to avoid breaking legitimate functionality.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today