---
id: CVE-2026-96902
title: >-
  Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details
  Disclosure via REST API
summary: >-
  The Easy Property Listings WordPress plugin before 3.5.28 does not restrict
  which listing fields it adds to the public REST API output, allowing
  unauthenticated users to read details a site has chosen to hide on published
  listings, such …
severity: none
cwe:
  - CWE-200
product: Easy Property Listings
affected:
  - easy_property_listings < 3.5.28
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T06:00:14.826Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-96902'
references:
  - url: 'https://wpscan.com/vulnerability/b89e410b-982d-44e0-850d-8325a51db365/'
tags:
  - cve.org
ingestedAt: '2026-10-20T06:54:24.004Z'
---

## Overview

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

## Affected

- `easy_property_listings < 3.5.28`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.