{"cvss":9.8,"datePublished":"2020-12-17T00:00:00Z","dateUpdated":"2020-12-17T00:00:00Z","description":"The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.","dueDate":"","id":"CVE-2020-36719","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"listingpro","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"cridio listingpro Missing Authorization","vendor":"cridio"}