Unauthorised CRM Data Exposure in Easy Property Listings WordPress Plugin

Executive Summary

The Easy Property Listings WordPress plugin before version 3.5.27 has a vulnerability where authenticated users with subscriber-level access or higher can read other users' CRM contact and lead records, including private activity notes. This happens because the plugin fails to perform proper authorization checks on certain contact-management read AJAX actions.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Easy Property Listings plugin version before 3.5.27. Log in as a subscriber or higher and attempt to access CRM contact records via AJAX actions. Look for unauthorized data exposure in activity logs or user interactions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privilege users like subscribers to access sensitive CRM data belonging to other users, including private notes. This could lead to unauthorized data exposure, privacy breaches, or misuse of contact and lead information stored in the plugin.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing personal or sensitive data without proper authorization. Unauthorized access to CRM records may result in legal penalties, reputational damage, and loss of trust due to privacy violations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Easy Property Listings plugin to version 3.5.27 or later immediately. Review user roles and permissions to ensure only necessary access is granted. Monitor for unusual activity in CRM contact records.

Useful 0 Not Useful 0