title: Multiple e-plugins - Subscriber+ Privilege Escalation
description: The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
problem types: CWE-269 Improper Privilege Management
affected:
{
vendor: Unknown
product: directory-pro
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.9.5
defaultStatus: unaffected
}
{
vendor: Unknown
product: final-user-wp-frontend-user-profiles
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.2.2
defaultStatus: unaffected
}
{
vendor: Unknown
product: producer-retailer
versions:
status: affected, versionType: custom, version: 0, lessThanOrEqual: TODO
defaultStatus: affected
}
{
vendor: Unknown
product: photographer-directory
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.0.9
defaultStatus: unaffected
}
{
vendor: Unknown
product: real-estate-pro
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.7.1
defaultStatus: unaffected
}
{
vendor: Unknown
product: institutions-directory
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.3.1
defaultStatus: unaffected
}
{
vendor: Unknown
product: lawyer-directory
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.2.9
defaultStatus: unaffected
}
{
vendor: Unknown
product: doctor-listing
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.3.6
defaultStatus: unaffected
}
{
vendor: Unknown
product: Hotel Listing
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.3.7
defaultStatus: unaffected
}
{
vendor: Unknown
product: fitness-trainer
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.4.1
defaultStatus: unaffected
}
{
vendor: Unknown
product: wp-membership
versions:
status: affected, versionType: custom, version: 0, lessThan: 1.5.7
defaultStatus: unaffected
}
