The Easy Property Listings WordPress plugin before version 3.5.27 permits authenticated users, even those with the subscriber role, to invoke several AJAX actions that should be authorized. These actions expose CRM contact and lead records, including private activity notes, without performing any access control checks. The result is that non-administrative users can view confidential information belonging to other users, potentially exposing personal data or proprietary business details.

WordPress sites running the Easy Property Listings plugin any version older than 3.5.27, regardless of other plugins or themes. The vulnerability exists in the plugin’s contact-management module and specifically affects all AJAX endpoints that read contact or lead records.

The absence of authorization checks allows any logged‑in user to read private data. No specific environmental prerequisites are mentioned, implying the flaw is exploitable as long as the user has basic authentication. EPSS score is < 1%, and the CVSS score of 4.3 reflects medium severity. The vulnerability is not listed in CISA’s KEV catalog; however, the capability to read sensitive lead and contact information presents a moderate risk of data leakage. Attackers would most likely exploit the flaw by logging into the WordPress backend as a subscriber or similar low‑privilege role and accessing the exposed AJAX endpoints, which would yield private user activities and other confidential notice information.