Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2020-36666: The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before

51
This month
HIGH 8.8UPGRADEUPGRADEUPGRADE

CVE-2020-36666 is a high-severity flaw (CVSS 8.8) affecting directory pro, final user, fitness trainer. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin befo

Why this priority

  • High severity
  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score8.8 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.9% (top 40%)
CISA exploited listNo
Published2023-03-27
Last modified2026-06-17
Publisher (CNA): WPScan · Vendor: e-plugins

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

e-plugins directory pro UPGRADE
Affected: < 1.9.5
Fixed in: 1.9.5
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy directory-pro || rpm -q directory-pro || directory-pro --version
2. UPGRADE to 1.9.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade directory-pro
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade directory-pro
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
e-plugins final user UPGRADE
Affected: < 1.2.2
Fixed in: 1.2.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy final-user || rpm -q final-user || final-user --version
2. UPGRADE to 1.2.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade final-user
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade final-user
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
e-plugins fitness trainer UPGRADE
Affected: < 1.4.1
Fixed in: 1.4.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy fitness-trainer || rpm -q fitness-trainer || fitness-trainer --version
2. UPGRADE to 1.4.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade fitness-trainer
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade fitness-trainer
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
e-plugins hospital \& doctor directory UPGRADE
Affected: < 1.3.6
Fixed in: 1.3.6
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy hospital--doctor-directory || rpm -q hospital--doctor-directory || hospital--doctor-directory --version
2. UPGRADE to 1.3.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade hospital--doctor-directory
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade hospital--doctor-directory
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
e-plugins hotel directory UPGRADE
Affected: < 1.3.7
Fixed in: 1.3.7
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy hotel-directory || rpm -q hotel-directory || hotel-directory --version
2. UPGRADE to 1.3.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade hotel-directory
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade hotel-directory
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
e-plugins institutions directory UPGRADE
Affected: < 1.3.1
Fixed in: 1.3.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy institutions-directory || rpm -q institutions-directory || institutions-directory --version
2. UPGRADE to 1.3.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade institutions-directory
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade institutions-directory
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-36666?

directory pro: upgrade to 1.9.5; final user: upgrade to 1.2.2; fitness trainer: upgrade to 1.4.1. Exact commands for each OS are on this page.

Is CVE-2020-36666 being exploited?

CVE-2020-36666 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-36666 affect?

CVE-2020-36666 affects directory pro, final user, fitness trainer. Severity is high (CVSS 8.8). The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro Word

How urgent is CVE-2020-36666?

Priority 51/100. High severity; Public exploit reference

Software pages

WordPress vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.