CVE-2020-36666

Multiple e-plugins - Subscriber+ Privilege Escalation

HIGH

8.8

CVSS Score

Published: March 27, 2023 at 03:37 PM UTC

Updated: June 17, 2026 at 03:15 AM UTC

11 products affected across 1 vendorDirectory ProWP MembershipInstitutions Directory

Using directory-pro by Unknown?

Get instant alerts when new vulnerabilities affect directory-pro - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.9%

SSVC

PoC

Description

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Directory Pro · E Pluginswordpress-plugin

95%

v < 1.9.5

Affected range stops below 1.9.5, so it looks safe — our inference, not a vendor statement

Final User · E Pluginsenvato

95%

v < 1.2.2

Affected range stops below 1.2.2, so it looks safe — our inference, not a vendor statement

Fitness Trainer · E Pluginswordpress-plugin

95%

v < 1.4.1

Affected range stops below 1.4.1, so it looks safe — our inference, not a vendor statement

Hospital & Doctor Directory · E Pluginsenvato

95%

v < 1.3.6

Affected range stops below 1.3.6, so it looks safe — our inference, not a vendor statement

Hotel Directory · E Pluginsenvato

95%

v < 1.3.7

Affected range stops below 1.3.7, so it looks safe — our inference, not a vendor statement

Institutions Directory · E Pluginswordpress-plugin

95%

v < 1.3.1

Affected range stops below 1.3.1, so it looks safe — our inference, not a vendor statement

Lawyer Directory · E Pluginsenvato

95%

v < 1.2.9

Affected range stops below 1.2.9, so it looks safe — our inference, not a vendor statement

Photographer Directory · E Pluginsenvato

95%

v < 1.0.9

Affected range stops below 1.0.9, so it looks safe — our inference, not a vendor statement

Producer Retailer · E Pluginsenvato

95%

v ≤ TODO

Real Estate Pro · E Pluginswordpress-plugin

95%

v < 1.7.1

Affected range stops below 1.7.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (2)

Product

Source: [email protected]

https://codecanyon.net/user/e-plugins

ExploitVDB EntryTechnical DescriptionThird Party Advisory

Source: [email protected]

https://wpscan.com/vulnerability/d079cb16-ead5-4bc8-b0b8-4a4dc2a54c96

SSVC — Action Prioritization

SSVCPoCNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card