CVE-2020-36721mediumCWE-284

CVE-2020-36721: medium-severity vulnerability in wpchill Brilliance

Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

Published · Updated

Follow this CVE+ Monitor Activello+ Monitor Brilliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.0%
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
silkalns · Activellosilkalns · Newspaper Xwpchill · Brilliance
Related CVEs — wpchill Brilliance

In the same product, most dangerous first.

CVE-2020-36708CRITICALEpsilon Framework Themes (Various Versions) - Function InjectionEPSS 65.3%