Easy Property Listings EUVD-2026-104801

Requires a valid authenticated account with a role as low as subscriber on a WordPress site running Easy Property Listings before version 3.5.27; the vulnerable contact-management read AJAX actions must be reachable (default plugin behavior). The practical limiting factor is the authentication requirement (PR:L): the attacker must either exploit open self-registration or otherwise acquire subscriber credentials. No special non-default configuration is needed beyond the plugin being installed and active, and no user interaction by a victim is required. Impact is read-only disclosure of CRM contact/lead records and private activity notes - not modification or denial of service.

This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) aligns well with the description: a network-reachable, low-complexity flaw requiring low privileges (an authenticated subscriber), with only limited confidentiality impact and no integrity or availability impact. CWE-200 (information disclosure) is consistent. The signals point toward low real-world urgency: EPSS is only 0.14% (3rd percentile), and the CVE is NOT on CISA KEV, indicating no evidence of active exploitation. However, publicly available exploit code exists (via WPScan), which raises opportunistic risk against unpatched sites that permit low-privilege user registration. The main gate on exploitation is the PR:L requirement - the attacker must already hold a subscriber-or-higher account, which limits mass exploitation to sites with open registration or where the attacker can otherwise obtain credentials. No conflicting signals were found between the CVSS vector and the description; both agree this is authenticated, network-based, read-only disclosure of other users' CRM data. Net: a real priority for sites with open user registration that store sensitive lead/contact data, but low priority elsewhere given the limited impact and absence of active exploitation.

An attacker registers (or obtains) a low-privilege subscriber account on a WordPress site running Easy Property Listings before 3.5.27, then invokes the plugin's unprotected contact-management read AJAX actions to enumerate and read other users' CRM contact and lead records, including private activity notes. Because public exploit code exists via WPScan and the attack requires no user interaction or elevated privileges, harvesting other users' private lead data is straightforward once an account is held.