CERT24GHSA-m32q-hxxr-f9w2: Unauthorized data access in Easy Property ListingsLoading data…
CERT24Threat Observatory
Period

GHSA-m32q-hxxr-f9w2: Unauthorized data access in Easy Property Listings

Easy Property Listings WordPress plugin versions before 3.5.27 do not perform authorization checks on several contact-management read AJAX actions. As a result, any authenticated user with a role as low as subscriber can read other users' CRM contact and lead records, including private activity notes.

← Back to intelligence

GHSA-m32q-hxxr-f9w2: Unauthorized data access in Easy Property Listings

Easy Property Listings WordPress plugin versions before 3.5.27 do not perform authorization checks on several contact-management read AJAX actions. As a result, any authenticated user with a role as low as subscriber can read other users' CRM contact and lead records, including private activity notes.