CVE-2025-64242

The Easy Property Listings plugin for WordPress, versions up to and including 3.5.22, contains a missing authorization vulnerability. This flaw stems from incorrectly configured access control security levels, which can be exploited to bypass intended permission checks [1].

An attacker does not need elevated privileges to exploit this issue; the broken access control allows unprivileged users to perform actions that should require higher-level permissions. The vulnerability is classified as a broken access control issue, meaning a missing authorization, authentication, or nonce token check in a function could lead to unauthorized actions [1].

The impact is considered low severity, and exploitation is unlikely according to the advisory. However, such vulnerabilities are known to be used in mass-exploit campaigns targeting thousands of websites [1].

The vulnerability has been patched in version 3.5.23. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins. If updating is not possible, contacting a hosting provider or web developer for assistance is recommended [1].