Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence
CVE-2020-36723ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
Medium 5.3
In plain English
A medium-severity information exposure in ListingPro - WordPress Directory & Listing Theme. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ListingPro - WordPress Directory & Listing Theme | 0 – before 2.6.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N