CVE-2020-36666 Multiple e-plugins - Subscriber+ Privilege Escalation
Multiple e-plugins WordPress plugins allow logged-in users to escalate privileges to administrator via insecure AJAX calls that update user metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36666?
CVE-2020-36666 is a high-severity vulnerability in Unknown Hotel Listing, published on 27 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
Which versions are affected by CVE-2020-36666?
It affects 11 products.
Products include E-Plugins Directory Pro, E-Plugins Final User, E-Plugins Fitness Trainer, E-Plugins Hospital \& Doctor Directory, E-Plugins Hotel Directory, E-Plugins Institutions Directory and 5 more.
How do I fix CVE-2020-36666?
No fix has been published for CVE-2020-36666 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36666 exists.
Sources
Also known as GHSA-p88j-jqx4-pp79.