The plugin contains an AJAX endpoint, mlsimport_logger_per_item, that lacks proper authorization and CSRF protection. The endpoint returns the import log file and import‑related metadata for any authenticated user, allowing a subscriber or other logged‑in user to read sensitive information such as listing details, configuration values, or system logs. The weakness is a lack of proper access control and request validation, which directly leads to data exposure without requiring elevated privileges.

WordPress installations that use the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings plugin version 7.0.3 or older are affected. Any authenticated user—subscriber, contributor, or otherwise—can trigger the vulnerable AJAX action and obtain the import log and metadata associated with arbitrary posts.

The vulnerability is exploitable by simply sending an AJAX request to the endpoint while logged in, as no authentication checks or CSRF tokens are required. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the potential impact is high because it permits disclosure of potentially confidential real‑estate data or internal configuration. The exploit does not require privileged access or network-level entry, so the threat surface is broad and should be treated with caution.