Critical severity9.8NVD Advisory· Published Jun 7, 2023· Updated Apr 8, 2026

CVE-2020-36719

Description

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.

Affected products

Cridio/Listingpro
cpe:2.3:a:cridio:listingpro:*:*:*:*:*:wordpress:*:*
Range: <=2.6.1
WordPress/Listingprollm-fuzzy
Range: <2.6.1
Package: https://wordpress.org/plugins/listingpro

Patches

Vulnerability mechanics

References

blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/nvdExploit
www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1acnvdThird Party Advisory
themeforest.net/item/listingpro-multipurpose-directory-theme/19386460nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000