The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
directory-pro
Vendor
Unknown
Product
directory-pro
Platforms
Unknown
Default status
unaffected
directory-pro · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.9.5
Unavailable
None listed
final-user-wp-frontend-user-profiles
Vendor
Unknown
Product
final-user-wp-frontend-user-profiles
Platforms
Unknown
Default status
unaffected
final-user-wp-frontend-user-profiles · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.2.2
Unavailable
None listed
producer-retailer
Vendor
Unknown
Product
producer-retailer
Platforms
Unknown
Default status
affected
producer-retailer · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
Unavailable
TODO
None listed
photographer-directory
Vendor
Unknown
Product
photographer-directory
Platforms
Unknown
Default status
unaffected
photographer-directory · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.0.9
Unavailable
None listed
real-estate-pro
Vendor
Unknown
Product
real-estate-pro
Platforms
Unknown
Default status
unaffected
real-estate-pro · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.7.1
Unavailable
None listed
institutions-directory
Vendor
Unknown
Product
institutions-directory
Platforms
Unknown
Default status
unaffected
institutions-directory · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.3.1
Unavailable
None listed
lawyer-directory
Vendor
Unknown
Product
lawyer-directory
Platforms
Unknown
Default status
unaffected
lawyer-directory · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.2.9
Unavailable
None listed
doctor-listing
Vendor
Unknown
Product
doctor-listing
Platforms
Unknown
Default status
unaffected
doctor-listing · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.3.6
Unavailable
None listed
Hotel Listing
Vendor
Unknown
Product
Hotel Listing
Platforms
Unknown
Default status
unaffected
Hotel Listing · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.3.7
Unavailable
None listed
fitness-trainer
Vendor
Unknown
Product
fitness-trainer
Platforms
Unknown
Default status
unaffected
fitness-trainer · Scoped product and version facts