CVE-2026-17515 Overview
CVE-2026-17515 affects the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin in versions prior to 7.0.4. The plugin exposes an AJAX action without authorization or Cross-Site Request Forgery (CSRF) checks. Any authenticated user, including a low-privileged subscriber, can invoke the action to read the plugin's import log file. The same weakness allows attackers to enumerate import-related metadata attached to arbitrary posts. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Authenticated subscribers can retrieve the plugin's import log and post-linked import metadata, leaking data intended for site administrators.
Affected Products
- MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings (WordPress plugin) versions prior to 7.0.4
- WordPress sites permitting subscriber-level or higher registration with the vulnerable plugin installed
- Real estate listing sites relying on MLSImport for IDX/MLS synchronization
Discovery Timeline
- 2026-08-05 - CVE-2026-17515 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-17515
Vulnerability Analysis
The MLSImport plugin registers an AJAX action handler that is reachable through the standard WordPress admin-ajax.php endpoint. WordPress exposes registered AJAX callbacks to any authenticated session by default when the wp_ajax_{action} hook is used without additional capability checks. In this plugin, the handler performs no capability verification and no nonce validation, meaning it neither confirms the caller's role nor validates request origin.
Once invoked, the handler returns the contents of the plugin's import log file. It also returns import-related metadata stored against arbitrary WordPress posts, which is normally reserved for administrators managing listing imports. The exposed data can include listing identifiers, source references, timestamps, and other operational details generated during MLS synchronization.
Because exploitation requires only a valid authenticated session, sites that allow public subscriber registration are directly reachable. Attackers can use the leaked metadata to fingerprint the import workflow, identify internal listing structures, and support follow-on attacks targeting the administrative interface.
Root Cause
The root cause is broken access control on an AJAX endpoint. The handler is registered without a call to current_user_can() for a privileged capability and without check_ajax_referer() to enforce a nonce. This combination violates two WordPress security requirements simultaneously: authorization and CSRF protection.
Attack Vector
An attacker authenticates to the target WordPress site using any account, including a self-registered subscriber. The attacker sends a crafted POST request to admin-ajax.php specifying the vulnerable action. The server responds with the import log contents and post metadata. No user interaction from an administrator is required. The vulnerability is exploitable over the network against any reachable WordPress installation running an affected version. Refer to the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-17515
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php originating from subscriber-level accounts referencing MLSImport actions.
- Access log entries showing repeated AJAX calls from a single low-privileged user session against the plugin's endpoints.
- Outbound transfers of import log data or listing metadata to unfamiliar client IPs shortly after subscriber account creation.
Detection Strategies
- Review WordPress access logs for admin-ajax.php traffic tied to MLSImport action parameters and correlate with the requesting user role.
- Alert on newly registered subscriber accounts that immediately issue AJAX requests to plugin-specific actions.
- Inspect web application firewall (WAF) telemetry for authenticated requests to plugin AJAX handlers lacking a valid _wpnonce parameter.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and forward events to a centralized log platform for correlation and retention.
- Track user role distribution and flag anomalous activity from accounts that should have no interaction with import workflows.
- Monitor the MLSImport plugin version across managed WordPress fleets and generate alerts for hosts running versions below 7.0.4.
How to Mitigate CVE-2026-17515
Immediate Actions Required
- Upgrade the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings to version 7.0.4 or later on all affected WordPress sites.
- Audit existing subscriber and low-privileged accounts and remove any that were not created by legitimate users.
- Disable open user registration on WordPress sites that do not require it, reducing the pool of accounts able to reach authenticated endpoints.
Patch Information
The vendor addressed the missing authorization and CSRF checks in MLSImport version 7.0.4. Site operators should update through the WordPress plugin dashboard or by deploying the patched release from the official plugin repository. Review the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the MLSImport plugin until the site can be updated to version 7.0.4 or later.
- Restrict access to /wp-admin/admin-ajax.php at the WAF or reverse proxy layer for MLSImport-specific action parameters until patched.
- Rotate any credentials or API keys that may have been referenced within the exposed import log file.
# Example: WP-CLI command to update the plugin to a patched version
wp plugin update mlsimport --version=7.0.4
# Verify the installed version after update
wp plugin get mlsimport --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
