The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Directory Pro Plugin | directory-pro-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Doctor Listing Plugin | doctor-listing-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Final User Wp Frontend User Profiles Plugin | final-user-wp-frontend-user-profiles-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Fitness Trainer Plugin | fitness-trainer-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Hotel Listing Plugin | hotel-listing-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Institutions Directory Plugin | institutions-directory-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Lawyer Directory Plugin | lawyer-directory-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Photographer Directory Plugin | photographer-directory-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Real Estate Pro Plugin | real-estate-pro-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 | |
| Wp Membership Plugin | wp-membership-plugin-cve-2020-36666 | May 15, 2025 | Mar 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub