MLSImport subscriber AJAX access exposes import logs and post metadata
MLSImport before 7.0.4 exposes an AJAX action without an authorization check or CSRF protection. Any authenticated user, including a Subscriber, can invoke it to read the plugin's import log and import-related metadata for arbitrary posts. This unscored record received deeper review because it gives a low-privilege account an information-disclosure primitive that may expose paths, import failures or listing metadata. The CNA does not disclose the AJAX action, parameters or handler function.
- Component
- MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings
- Affected
- < 7.0.4
- Safe version
7.0.4- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update MLSImport to 7.0.4 or later. Review low-privilege accounts and requests to MLSImport AJAX actions, and treat secrets or sensitive paths written to historical import logs as potentially disclosed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N