CVE-2020-36708 Epsilon Framework Themes (Various Versions) - Function Injection
Unauthenticated attackers can achieve remote code execution via function injection in multiple Epsilon Framework WordPress themes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36708?
CVE-2020-36708 is a critical code injection vulnerability in machothemes Activello, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.
Weakness: CWE-94
Which versions are affected by CVE-2020-36708?
It affects 16 products.
Products include Colorlib Activello, Colorlib Bonkers, Colorlib Illdy, Colorlib Newspaper X, Colorlib Pixova Lite, Colorlib Shapely and 10 more.
How do I fix CVE-2020-36708?
No fix has been published for CVE-2020-36708 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-36708 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36708 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in machothemes Activello
Sources
Also known as GHSA-48h4-c5mw-4h8j.