Authorization Bypass in Real Estate Listings Plugin by WordPress
CVE-2026-17515
Currently unrated
What is CVE-2026-17515?
The IDX Plugin & MLS Plugin for Real Estate Listings for WordPress before version 7.0.4 lacks necessary authorization and Cross-Site Request Forgery (CSRF) checks within its AJAX actions. This oversight permits any authenticated user to gain unauthorized access to sensitive information, including the import log file and related metadata for arbitrary posts, posing a significant risk to the site's security and data integrity.
Affected Version(s)
MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings 0 < 7.0.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.