The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
References
| Link | Resource |
|---|---|
| https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=cve | Third Party Advisory |
| https://wordpress.org/themes/activello/ | Product |
| https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/ | Exploit Third Party Advisory |
| https://wordpress.org/themes/brilliance/ | Product |
| https://wordpress.org/themes/newspaper-x/ | Product |
Configurations
Configuration 1 (hide)
|
History
16 Jun 2023, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://wordpress.org/themes/newspaper-x/ - Product | |
| References | (MISC) https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/ - Exploit, Third Party Advisory | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=cve - Third Party Advisory | |
| References | (MISC) https://wordpress.org/themes/brilliance/ - Product | |
| References | (MISC) https://wordpress.org/themes/activello/ - Product | |
| CPE | cpe:2.3:a:colorlib:newspaper_x:*:*:*:*:*:wordpress:*:* cpe:2.3:a:colorlib:shapely:*:*:*:*:*:wordpress:*:* cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:* cpe:2.3:a:machothemes:medzone_lite:*:*:*:*:*:wordpress:*:* cpe:2.3:a:colorlib:bonkers:*:*:*:*:*:wordpress:*:* cpe:2.3:a:cpothemes:brilliance:*:*:*:*:*:wordpress:*:* cpe:2.3:a:machothemes:antreas:*:*:*:*:*:wordpress:*:* cpe:2.3:a:cpothemes:allegiant:*:*:*:*:*:wordpress:*:* cpe:2.3:a:colorlib:illdy:*:*:*:*:*:wordpress:*:* cpe:2.3:a:cpothemes:affluent:*:*:*:*:*:wordpress:*:* cpe:2.3:a:cpothemes:transcend:*:*:*:*:*:wordpress:*:* cpe:2.3:a:colorlib:pixova_lite:*:*:*:*:*:wordpress:*:* cpe:2.3:a:machothemes:regina_lite:*:*:*:*:*:wordpress:*:* cpe:2.3:a:machothemes:newsmag:*:*:*:*:*:wordpress:*:* cpe:2.3:a:machothemes:naturemag_lite:*:*:*:*:*:wordpress:*:* |
|
| First Time |
Cpothemes transcend
Machothemes regina Lite Colorlib newspaper X Cpothemes affluent Machothemes antreas Colorlib Colorlib illdy Machothemes newsmag Cpothemes Cpothemes brilliance Colorlib shapely Machothemes naturemag Lite Machothemes Colorlib activello Cpothemes allegiant Machothemes medzone Lite Colorlib pixova Lite Colorlib bonkers |
|
| CWE | CWE-862 |
07 Jun 2023, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2023-11-07 03:22
NVD link : CVE-2020-36721
Mitre link : CVE-2020-36721
JSON object : View
Products Affected
cpothemes
- brilliance
- affluent
- allegiant
- transcend
colorlib
- shapely
- newspaper_x
- illdy
- bonkers
- pixova_lite
- activello
machothemes
- newsmag
- naturemag_lite
- antreas
- medzone_lite
- regina_lite
CWE
CWE-862
Missing Authorization