ListingPro <= 2.6 is vulnerable to Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation vulnerability

Unauthenticated

Published
2020-12-16

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.

CVE

https://www.cve.org/CVERecord?id=CVE-2020-36719

CVSS

Score:6.5

Severity:Medium

Version: 2.6

There is a patch available in v2.6.1 and we strongly recommend you update to this version as soon as possible.