Missing authorization controls in the Easy Property Listings plugin allow an attacker to bypass intended access restrictions. Because the plugin does not enforce proper authorization on certain endpoints, a user could potentially view or edit property listings, manage plugin settings, or access sensitive data without valid credentials. This weakness is classified as CWE-862, which indicates that the software fails to check whether a user is authorized to perform an action.

Affected installations are WordPress sites running the Easy Property Listings plugin version 3.5.22 or earlier. The vendor responsible is Merv Barrett. No explicit version range is listed beyond “up to 3.5.22”, so any site deploying a compatible version is at risk.

The CVSS score of 4.3 places this vulnerability in the medium risk category, while an EPSS less than 1 % indicates a very low likelihood of current exploitation. It does not appear in the CISA KEV catalog. The attack vector is likely via the web application, where a non‑privileged user could submit crafted requests to exposed plugin endpoints. Because the issue arises from incorrect configuration of access‑control security levels, an attacker need not exploit a separate bug; they must merely locate an endpoint that lacks proper authorization checks.