{"id":"CVE-2026-96903","published":"2026-10-20T06:16:58.190","lastModified":"2026-10-20T06:16:58.190","description":"The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/52b63cac-2730-4395-bf68-3a55aceb0e14/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}