Mlsimport
Monthly
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.