The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.
References
Configurations
History
21 Nov 2024, 05:30
Type | Values Removed | Values Added |
---|---|---|
References | () https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/ - Exploit | |
References | () https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460 - Product | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1ac?source=cve - Third Party Advisory |
13 Jun 2023, 16:10
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:cridio:listingpro:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CWE | CWE-862 | |
References | (MISC) https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/ - Exploit | |
References | (MISC) https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460 - Product | |
References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1ac?source=cve - Third Party Advisory |
07 Jun 2023, 02:45
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-11-21 05:30
NVD link : CVE-2020-36719
Mitre link : CVE-2020-36719
CVE.ORG link : CVE-2020-36719
JSON object : View
Products Affected
cridio
- listingpro
CWE
CWE-862
Missing Authorization