CVE-2025-64242

MediumCVSS 4.3

Published: 16/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The Easy Property Listings plugin by Merv Barrett contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 3.5.22.

Risk Assessment

An attacker could exploit missing authorization to access functions or data without proper permissions, potentially leading to integrity and confidentiality breaches.

Recommendation

Update the Easy Property Listings plugin to the latest patched version. Review and fix access control configurations and restrict access to sensitive functions.

Other vulnerabilities in Easy Property Listings

CVE-2026-16684Medium
The Easy Property Listings plugin for WordPress up to version 3.5.24 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'facebook' user contact method. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

Original NVD description (English source)

Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS