UNKNOWN NVD

CVE-2026-96903

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.

References

https://wpscan.com/vulnerability/52b63cac-2730-4395-bf68-3a55aceb0e14/

Published: 2026-10-20 · Source: NVD · Feed updated: 2026-10-20

This unknown severity vulnerability was published on 2026-10-20 via NVD.

vulnfeed aggregates 17028 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.