Easy Property Listings EUVD-2026-104800

No authentication and no user interaction required (CVSS PR:N/UI:N): any unauthenticated remote user can reach the affected public REST API output on an affected site. The specific precondition is that the site is running Easy Property Listings before 3.5.28 AND has published listings where certain fields (asking price, sold price, street address, exact map coordinates) were configured to be hidden from public front-end display - the flaw is that the plugin fails to restrict those hidden fields from the REST API response. Exploitation is limited to READING these listing fields only; there is no write, auth-bypass, or code-execution capability. The practical limiting factor is data sensitivity per site: sites that chose to hide price/address/location data are exposed, whereas sites that display all fields publicly have nothing additional to leak.

This is a genuine but low-to-moderate priority issue, and the multiple signals here are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) indicates a remotely reachable, unauthenticated, low-complexity flaw with no user interaction - easy to trigger - but with only limited confidentiality impact and zero integrity or availability impact, which is the ceiling on its severity. EPSS is low (0.18%, 8th percentile), meaning statistically low probability of broad opportunistic exploitation in the next 30 days, and the vulnerability is NOT in CISA KEV, so there is no evidence of active real-world exploitation. However, public exploit code exists (WPScan), lowering the bar for a motivated actor to reproduce it. The SSVC framing would be: exploitation = public PoC (not active), automatable = yes (unauthenticated REST scraping scales trivially across sites), technical impact = partial (information disclosure only). In short, it is a confirmed, easily-automated data-leak with a real PoC but no active exploitation and a low blast radius per site - prioritize patching for sites handling sensitive listing data, but it is not an emergency relative to RCE- or auth-bypass-class flaws.

An unauthenticated attacker queries the plugin's public REST API endpoint for published property listings and receives listing fields the site owner intentionally hid in the front-end display - such as asking price, final sold price, exact street address, and precise GPS map coordinates. Because public exploit code is available (WPScan) and no authentication or user interaction is required, an attacker can script this against many Easy Property Listings sites to harvest hidden pricing and location data at scale.