CVE-2020-36723 ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure

What is CVE-2020-36723?

CVE-2020-36723 is a medium-severity vulnerability in ListingPro - WordPress Directory & Listing Theme, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.

Weakness: CWE-200

Which versions are affected by CVE-2020-36723?

It affects 1 product.

Products include Cridio Listingpro.

How do I fix CVE-2020-36723?

No fix has been published for CVE-2020-36723 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36723 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36723 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in ListingPro - WordPress Directory & Listing Theme

• CVE-2020-36719 ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation Critical 9.8
• CVE-2024-38795 WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability Critical 9.3
• CVE-2024-39622 WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability Critical 9.3
• CVE-2024-39619 WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerability Critical 9.0
• CVE-2024-39623 WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r88m-vgvq-wfmf.