What’s Vulnerable › Vulnerabilities

CVE-2020-36721: Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-07 · updated 2026-06-17
• Weakness: CWE-284

Description

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.

Affected products

• Silkalns Activello: before 1.4.2 — fixed in 1.4.2
• silkalns Bonkers: before 1.0.6 — fixed in 1.0.6
• silkalns Illdy: before 2.1.7 — fixed in 2.1.7
• silkalns Newspaper X: before 1.3.2 — fixed in 1.3.2
• silkalns Pixova Lite: before 2.0.7 — fixed in 2.0.7
• silkalns Shapely: before 1.2.9 — fixed in 1.2.9
• Cpothemes Affluent: before 1.1.2 — fixed in 1.1.2
• WP Chill Allegiant: before 1.2.6 — fixed in 1.2.6
• Cpothemes Brilliance: before 1.3.0 — fixed in 1.3.0
• Cpothemes Transcend: before 1.2.0 — fixed in 1.2.0
• machothemes Antreas: before 1.0.7 — fixed in 1.0.7
• machothemes MedZone Lite: before 1.2.6 — fixed in 1.2.6
• machothemes NatureMag Lite: through 1.0.4
• Macho Themes NewsMag: before 2.4.2 — fixed in 2.4.2
• Macho Themes Regina Lite: before 2.0.6 — fixed in 2.0.6

How to fix

Upgrade to a fixed version: Silkalns Activello 1.4.2; silkalns Bonkers 1.0.6; silkalns Illdy 2.1.7; silkalns Newspaper X 1.3.2; silkalns Pixova Lite 2.0.7; silkalns Shapely 1.2.9; Cpothemes Affluent 1.1.2; WP Chill Allegiant 1.2.6; Cpothemes Brilliance 1.3.0; Cpothemes Transcend 1.2.0; machothemes Antreas 1.0.7; machothemes MedZone Lite 1.2.6. Check the vendor advisory for mitigations.

References

• https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
• https://wordpress.org/themes/activello/
• https://wordpress.org/themes/brilliance/
• https://wordpress.org/themes/newspaper-x/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=cve
• https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
• https://wordpress.org/themes/activello/
• https://wordpress.org/themes/brilliance/
• https://wordpress.org/themes/newspaper-x/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=cve

Get alerted when CVE-2020-36721 or the next vulnerability affects your stack