CVE:CVE-2020-36666
CNNVD:CNNVD-202303-2250
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress plugin directory-pro 1.9.5 版本之前存在安全漏洞，该漏洞源于没有对 AJAX 端口进行权限验证操作。
solution:Upgrade e-plugins directory_pro to a higher version than 1.9.5,and avoid the version (,1.9.5); Upgrade e-plugins final_user to a higher version than 1.2.2,and avoid the version (,1.2.2); Upgrade e-plugins fitness_trainer to a higher version than 1.4.1,and avoid the version (,1.4.1); Upgrade e-plugins hospital_&_doctor_directory to a higher version than 1.3.6,and avoid the version (,1.3.6); Upgrade e-plugins hotel_directory to a higher version than 1.3.7,and avoid the version (,1.3.7); Upgrade e-plugins institutions_directory to a higher version than 1.3.1,and avoid the version (,1.3.1); Upgrade e-plugins lawyer_directory to a higher version than 1.2.9,and avoid the version (,1.2.9); Upgrade e-plugins photographer-directory to a higher version than 1.0.9,and avoid the version (,1.0.9); Upgrade e-plugins producer-retailer to a higher version than -; Upgrade e-plugins real_estate_pro to a higher version than 1.7.1,and avoid the version (,1.7.1); Upgrade e-plugins wp_membership to a higher version than 1.5.7,and avoid the version (,1.5.7)