WordPress security changelog
MEDIUM CVE-2020-36723 Modified

ListingPro - WordPress Directory & Listing: A security weakness

ListingPro - WordPress Directory & Listing is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score 5.3 CVSS 3.1 · nvd@nist.gov
Component
ListingPro - WordPress Directory & Listing
Plugin slug
listingpro
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Jun 07, 2023
Weakness
CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
NVD-CWE-noinfo

This CVE was published Jun 07, 2023 and is one of 18 known issues for this theme.

What to do

Patch or disable the affected component.

Update ListingPro - WordPress Directory & Listing to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Primary and upstream sources