Log in Start free

Vulnerability · Published Mar 27, 2023 · Assigned by WPScan

CVE-2020-36666Multiple e-plugins - Subscriber+ Privilege Escalation

High 8.8

In plain English

A high-severity security flaw in directory-pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 40.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.

Affected products (as reported)

VendorProductVersions
Unknown directory-pro 0 – before 1.9.5
Unknown final-user-wp-frontend-user-profiles 0 – before 1.2.2
Unknown producer-retailer 0 – through TODO
Unknown photographer-directory 0 – before 1.0.9
Unknown real-estate-pro 0 – before 1.7.1
Unknown institutions-directory 0 – before 1.3.1
Unknown lawyer-directory 0 – before 1.2.9
Unknown doctor-listing 0 – before 1.3.6
Unknown Hotel Listing 0 – before 1.3.7
Unknown fitness-trainer 0 – before 1.4.1
Unknown wp-membership 0 – before 1.5.7

References