CVE-2020-36721
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS
Percentile
56.8%
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the ‘activello_activate_plugin’ and ‘activello_deactivate_plugin’ functions in the ‘inc/welcome-screen/class-activello-welcome.php’ file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| colorlib | activello | * | cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:* |
| colorlib | bonkers | * | cpe:2.3:a:colorlib:bonkers:*:*:*:*:*:wordpress:*:* |
| colorlib | illdy | * | cpe:2.3:a:colorlib:illdy:*:*:*:*:*:wordpress:*:* |
| colorlib | newspaper_x | * | cpe:2.3:a:colorlib:newspaper_x:*:*:*:*:*:wordpress:*:* |
| colorlib | pixova_lite | * | cpe:2.3:a:colorlib:pixova_lite:*:*:*:*:*:wordpress:*:* |
| colorlib | shapely | * | cpe:2.3:a:colorlib:shapely:*:*:*:*:*:wordpress:*:* |
| cpothemes | affluent | * | cpe:2.3:a:cpothemes:affluent:*:*:*:*:*:wordpress:*:* |
| cpothemes | allegiant | * | cpe:2.3:a:cpothemes:allegiant:*:*:*:*:*:wordpress:*:* |
| cpothemes | brilliance | * | cpe:2.3:a:cpothemes:brilliance:*:*:*:*:*:wordpress:*:* |
| cpothemes | transcend | * | cpe:2.3:a:cpothemes:transcend:*:*:*:*:*:wordpress:*:* |
References
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS
Percentile
56.8%