ListingPro < 2.6.1 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation
Description
Unauthenticated users could install/activate/deactivate arbitrary plugins, including install one from a remote source under their control (by having $_REQUEST['ccDestin'] set to external and $_REQUEST['ccFileUrl'] to the remote ZIP file)
Affects Themes
Fixed in version 2.6.1✓
Classification
Miscellaneous
Original Researcher
Jerome Bruandet (nintechnet)
Verified
No
Timeline
Publicly Published
2020-12-17 (about 4 months ago)
Added
2020-12-17 (about 4 months ago)
Last Updated
2020-12-18 (about 4 months ago)