{"id":"CVE-2026-17515","aliases":["EUVD-2026-53122","GHSA-rrqj-x694-jg5v"],"status":"published","title":"MLS Import \u003c 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item","description":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0016,"percentile":0.05189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-352"],"published":"2026-08-05T06:00:12Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"unknown","product":"mlsimport: idx plugin \u0026 mls plugin for real estate listings"}],"references":[{"url":"https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-ca924a60f909/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17515"},{"url":"https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-ca924a60f909"},{"url":"https://github.com/advisories/GHSA-rrqj-x694-jg5v"}],"sources":{"cve":[{"id":"CVE-2026-17515","title":"MLS Import \u003c 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item","description":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.","status":"published","published":"2026-08-05T06:00:12.918Z","modified":"2026-08-05T13:54:29.194Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200","CWE-352"],"updated_at":"2026-11-02T14:19:54.50686Z"}],"euvd":[{"id":"EUVD-2026-53122","description":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.","status":"published","published":"2026-08-05T06:00:12Z","modified":"2026-08-05T13:54:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:10.319044Z"}],"ghsa":[{"id":"GHSA-rrqj-x694-jg5v","title":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4...","description":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.","status":"published","published":"2026-08-05T09:31:15Z","modified":"2026-08-05T15:32:14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-17515","description":"The MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin \u0026 MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.","status":"published","published":"2026-08-05T07:16:37.207Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-352"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}