Description
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Unknown directory-pro
Default version status: unaffected
0 to < 1.9.5affected
Unknown final-user-wp-frontend-user-profiles
Default version status: unaffected
0 to < 1.2.2affected
Unknown producer-retailer
Default version status: affected
0 to ≤ TODOaffected
Unknown photographer-directory
Default version status: unaffected
0 to < 1.0.9affected
Unknown real-estate-pro
Default version status: unaffected
0 to < 1.7.1affected
Unknown institutions-directory
Default version status: unaffected
0 to < 1.3.1affected
Unknown lawyer-directory
Default version status: unaffected
0 to < 1.2.9affected
Unknown doctor-listing
Default version status: unaffected
0 to < 1.3.6affected
Unknown Hotel Listing
Default version status: unaffected
0 to < 1.3.7affected
Unknown fitness-trainer
Default version status: unaffected
0 to < 1.4.1affected
Unknown wp-membership
Default version status: unaffected
0 to < 1.5.7affected