CVE-2020-36666
Description
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
How to fix
- e-plugins directory_pro1.9.5 or later
- e-plugins final_user1.2.2 or later
- e-plugins fitness_trainer1.4.1 or later
- e-plugins hospital_\&_doctor_directory1.3.6 or later
- e-plugins hotel_directory1.3.7 or later
- e-plugins institutions_directory1.3.1 or later
- e-plugins lawyer_directory1.2.9 or later
- e-plugins photographer-directory1.0.9 or later
- e-plugins real_estate_pro1.7.1 or later
- e-plugins wp_membership1.5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| e-plugins directory_pro | v < 1.9.5 | 1.9.5 |
| e-plugins final_user | v < 1.2.2 | 1.2.2 |
| e-plugins fitness_trainer | v < 1.4.1 | 1.4.1 |
| e-plugins hospital_\&_doctor_directory | v < 1.3.6 | 1.3.6 |
| e-plugins hotel_directory | v < 1.3.7 | 1.3.7 |
| e-plugins institutions_directory | v < 1.3.1 | 1.3.1 |
| e-plugins lawyer_directory | v < 1.2.9 | 1.2.9 |
| e-plugins photographer-directory | v < 1.0.9 | 1.0.9 |
| e-plugins producer-retailer | No range specified | — |
| e-plugins real_estate_pro | v < 1.7.1 | 1.7.1 |
| e-plugins wp_membership | v < 1.5.7 | 1.5.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.