CVE-2026-96902: Easy Property Listings 0 to before 3.5.28

Affected technology

Easy Property Listings · 0 to before 3.5.28
Vendor not specified by the source

Description’s affected range: before 3.5.28 does not restrict which listing fields it adds to the public REST API output

Component: Not specified by the source

What an attacker can do

Unauthenticated users can read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.