CVE Feed

    Dashboard / CVE / CVE-2020-36666

    CVE-2020-36666

    The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.

    Published:Mar 27, 2023
    Last Modified:Feb 19, 2025
    EPS:Mar 27, 2023
    EPSS Score:0.0029
    CVSS Score:8.8

    Affected Products

    Vendor
    E-plugins
    Product
    Directory Pro
    Vendor
    E-plugins
    Product
    Final User
    Vendor
    E-plugins
    Product
    Fitness Trainer
    Vendor
    E-plugins
    Product
    Hospital \& Doctor Directory
    Vendor
    E-plugins
    Product
    Hotel Directory
    Vendor
    E-plugins
    Product
    Institutions Directory
    Vendor
    E-plugins
    Product
    Lawyer Directory
    Vendor
    E-plugins
    Product
    Photographer-directory
    Vendor
    E-plugins
    Product
    Producer-retailer
    Vendor
    E-plugins
    Product
    Real Estate Pro
    Vendor
    E-plugins
    Product
    Wp Membership

    Exploits

    https://wpscan.com/vulnerability/d079cb16-ead5-4bc8-b0b8-4a4dc2a54c96https://wpscan.com/vulnerability/d079cb16-ead5-4bc8-b0b8-4a4dc2a54c96

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High