CVE-2020-36723

EUVD-2020-24165
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
WordfenceCNA
5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
cridiolistingpro
𝑥
< 2.6.1
𝑥
= Vulnerable software versions
References
https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/
https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460
https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b21f8e-8d66-4d3e-a383-bea20a3c4498?source=cve
https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/
https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460
https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b21f8e-8d66-4d3e-a383-bea20a3c4498?source=cve