CVE-2020-36666: Multiple e-plugins - Subscriber+ Privilege Escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-27 · updated 2026-06-17

Description

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.

Affected products

e-plugins Directory Pro: before 1.9.5 — fixed in 1.9.5
e-plugins Final User: before 1.2.2 — fixed in 1.2.2
e-plugins Fitness Trainer: before 1.4.1 — fixed in 1.4.1
e-plugins Hospital & Doctor Directory: before 1.3.6 — fixed in 1.3.6
e-plugins Hotel Directory: before 1.3.7 — fixed in 1.3.7
e-plugins Institutions Directory: before 1.3.1 — fixed in 1.3.1
e-plugins Lawyer Directory: before 1.2.9 — fixed in 1.2.9
e-plugins Photographer-Directory: before 1.0.9 — fixed in 1.0.9
e-plugins Producer-Retailer: all versions
e-plugins Real Estate Pro: before 1.7.1 — fixed in 1.7.1
e-plugins WP Membership: before 1.5.7 — fixed in 1.5.7

How to fix

Upgrade to a fixed version: e-plugins Directory Pro 1.9.5; e-plugins Final User 1.2.2; e-plugins Fitness Trainer 1.4.1; e-plugins Hospital & Doctor Directory 1.3.6; e-plugins Hotel Directory 1.3.7; e-plugins Institutions Directory 1.3.1; e-plugins Lawyer Directory 1.2.9; e-plugins Photographer-Directory 1.0.9; e-plugins Real Estate Pro 1.7.1; e-plugins WP Membership 1.5.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36666 or the next vulnerability affects your stack