{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-36719/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-36719/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-36719/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-36719/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-36719/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-36719"},"sightings":{"href":"/api/v1/sightings/cve-2020-36719"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-36719.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-36719\n\ninfo:\n  name: ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation\n  author: ritikchaddha\n  severity: critical\n  description: |\n    The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.\n  impact: |\n    Unauthenticated attackers can arbitrarily install, activate or deactivate plugins, potentially installing malicious plugins to gain complete site control.\n  remediation: |\n    Upgrade to ListingPro version 2.6.1 or later.\n  reference:\n    - https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-36719\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-36719\n    epss-score: 0.04304\n    epss-percentile: 0.91183\n    cwe-id: CWE-862\n    cpe: cpe:2.3:a:cridio:listingpro:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: cridio\n    product: listingpro\n    fofa-query: body=\"/wp-content/plugins/listingpro\"\n  tags: cve,cve2020,wp,wp-pluginwordpress,listingpro,passive,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/themes/listingpro/style.css\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"ListingPro\"\n          - \"Version:\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - compare_versions(detected_version, '< 2.6.1')\n          - status_code == 200\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        name: detected_version\n        group: 1\n        regex:\n          - '(?i)Version:\\s?([\\w.]+)'\n# digest: 490a0046304402204ba5aabb1b97702784e28899c5dfded7fd7b0896824455b4510451ddc4f0070402204873f7df080a1aeb2dcafd20445a42fa21c342ad3c25d0e6a15dbfd9a643984a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-36719"}