CVE-2020-36666

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

27/03/2023

Last modified:

19/02/2025

Description

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.80

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:e-plugins:directory_pro::::::wordpress::*		1.9.5 (excluding)
cpe:2.3:a:e-plugins:final_user::::::wordpress::*		1.2.2 (excluding)
cpe:2.3:a:e-plugins:fitness_trainer::::::wordpress::*		1.4.1 (excluding)
cpe:2.3:a:e-plugins:hospital_\&_doctor_directory::::::wordpress::*		1.3.6 (excluding)
cpe:2.3:a:e-plugins:hotel_directory::::::wordpress::*		1.3.7 (excluding)
cpe:2.3:a:e-plugins:institutions_directory::::::wordpress::*		1.3.1 (excluding)
cpe:2.3:a:e-plugins:lawyer_directory::::::wordpress::*		1.2.9 (excluding)
cpe:2.3:a:e-plugins:photographer-directory::::::wordpress::*		1.0.9 (excluding)
cpe:2.3:a:e-plugins:producer-retailer:-:::::wordpress::
cpe:2.3:a:e-plugins:real_estate_pro::::::wordpress::*		1.7.1 (excluding)
cpe:2.3:a:e-plugins:wp_membership::::::wordpress::*		1.5.7 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2020-36666

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools