Missing Authorization Vulnerability in Merv Barrett Easy Property Listings Plugin
CVE-2025-68072

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Easy Property Listings
Vendor
CVE Published:
22 January 2026

What is CVE-2025-68072?

A missing authorization vulnerability has been identified in the Merv Barrett Easy Property Listings plugin for WordPress. This issue arises from incorrectly configured access control security levels, which could potentially allow unauthorized users to gain access to restricted features. The vulnerability impacts versions 3.5.16 and below, necessitating immediate attention to ensure integrity and security within your WordPress installations.

Affected Version(s)

Easy Property Listings 0 <= 3.5.20

References

https://patchstack.com/database/Wordpress/Plugin/easy-pro...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.