Unauthenticated Sensitive Data Exposure in Easy Property Listings WordPress Plugin

Executive Summary

This vulnerability affects the Easy Property Listings WordPress plugin before version 3.5.28. It allows unauthenticated users to access hidden listing details through the public REST API, including sensitive data like asking price, sold price, street address, and exact map coordinates. The issue occurs because the plugin does not restrict which fields are exposed in the REST API output.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Easy Property Listings plugin version prior to 3.5.28. Inspect REST API responses for exposed sensitive fields like asking price, sold price, street address, or map coordinates. Use tools like curl to query the API endpoint /wp-json/wp/v2/properties or similar.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could access private listing information, such as property prices and exact locations, which were intended to be hidden. This could lead to privacy breaches, unauthorized data collection, or misuse of sensitive property details.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR by exposing personal or sensitive property information without consent. It may also conflict with privacy requirements under HIPAA if property details relate to individuals' health or location data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Easy Property Listings plugin to version 3.5.28 or later immediately. If updating is not possible, consider disabling the plugin temporarily or restricting access to the REST API endpoints until the update is applied.

Useful 0 Not Useful 0