The vulnerability is a missing authorization flaw in the Easy Property Listings plugin, allowing attackers to exploit incorrectly configured access control levels. This broken access control can enable an unauthenticated or low‑privilege user to view, modify, or delete property listings, jeopardizing site data confidentiality, integrity, and availability. The flaw is categorized as CWE-862.

Merv Barrett Easy Property Listings plugin for WordPress, versions up to and including 3.5.20. Any WordPress installation running one of those plugin versions is susceptible unless the plugin is upgraded or its access level settings are corrected.

The reported CVSS score of 6.5 indicates moderate impact, and the EPSS score of less than 1% suggests a very low current exploitation probability. The flaw is not listed in the CISA KEV inventory. Attackers can reach the vulnerability through the public web interface, typically by logging into any standard user account; because the plugin fails to enforce proper authorization, that user can perform privileged actions such as editing or deleting listings.