CVE

CVE-2020-36719

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

listingpro - wordpress directory & listing theme

Updated Oct 24, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2020-36719 Scanner

CVE-2020-36719 Scanner - Arbitrary Plugin Installation/Activation/Deactivation vulnerability in ListingPro

Used 2.7k times · 3.4k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →