Themes Vulnerabilities
ListingPro < 2.6.1 - Unauthenticated Arbitrary Plugin Installation/Activation/Deactivation
Description
Unauthenticated users could install/activate/deactivate arbitrary plugins, including install one from a remote source under their control (by having $_REQUEST['ccDestin'] set to external and $_REQUEST['ccFileUrl'] to the remote ZIP file)
Affects Themes
Fixed in version 2.6.1
References
Classification
Miscellaneous
Original Researcher
Jerome Bruandet (nintechnet)
Verified
No
Timeline
Publicly Published
2020-12-17 (about 1 years ago)
Added
2020-12-17 (about 1 years ago)
Last Updated
2020-12-18 (about 1 years ago)