The Easy Property Listings WordPress plugin before version 3.5.28 fails to limit the listing fields it exposes through its public REST API. As a result, unauthenticated users can retrieve hidden information such as the asking price, sold price, street address, and exact map coordinates. This leakage allows any internet user to obtain detailed property data that site owners intended to keep private, constituting a clear privacy breach.

WordPress sites that are running Easy Property Listings with a version older than 3.5.28 are affected. The vendor is listed only as Unknown:Easy Property Listings in the CNA records, and no additional distribution channels or versions are documented.

The vulnerability can be abused simply by accessing the public REST endpoint without authentication, making it trivial for anyone online. The EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation has been observed. Because the attack requires no credentials or special configuration, the likelihood of exploitation in environments where the REST API is publicly reachable remains high. With a CVSS score of 5.3, the impact is moderate but still significant for sites hosting high‑value listings.