CVE-2020-36719

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/Exploit
• https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1ac?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-listingpro-theme-fixed-a-critical-vulnerability/Exploit
• https://themeforest.net/item/listingpro-multipurpose-directory-theme/19386460Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1ac?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36713The MStore API plugin for WordPress is vulnerable to authent…9.8
• CVE-2020-36714The Brizy plugin for WordPress is vulnerable to authorizatio…8.1
• CVE-2020-36715The Login/Signup Popup plugin for WordPress is vulnerable to…4.6
• CVE-2020-36716The WP Activity Log plugin for WordPress is vulnerable to au…7.3
• CVE-2020-36717The Kali Forms plugin for WordPress is vulnerable to Cross-S…8.8
• CVE-2020-36718The GDPR CCPA Compliance Support plugin for WordPress is vul…9.8
• CVE-2020-36720The Kali Forms plugin for WordPress is vulnerable to Authent…7.1
• CVE-2020-36721The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X…6.5
• CVE-2020-36722The Visual Composer plugin for WordPress is vulnerable to Cr…4.8
• CVE-2020-36723The ListingPro - WordPress Directory & Listing Theme for Wor…5.3
• CVE-2020-36724The Wordable plugin for WordPress is vulnerable to authentic…9.8
• CVE-2020-36725The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro …8.1