Authorization Bypass in Real Estate Listings Plugin by WordPress
CVE-2026-17515

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Mlsimport: Idx Plugin & Mls Plugin For Real Estate Listings
Vendor
CVE Published:
5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-17515?

The IDX Plugin & MLS Plugin for Real Estate Listings for WordPress before version 7.0.4 lacks necessary authorization and Cross-Site Request Forgery (CSRF) checks within its AJAX actions. This oversight permits any authenticated user to gain unauthorized access to sensitive information, including the import log file and related metadata for arbitrary posts, posing a significant risk to the site's security and data integrity.

Affected Version(s)

MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings 0 < 7.0.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-17515 - Proof of Concept

References

https://wpscan.com/vulnerability/8c8da95c-df83-4788-bcb2-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shikhali Jamalzade
WPScan
.