CVE-2020-36721

Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

6.5 Medium

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.97%Up 0.9 points since Jun 7, 2023

What each source reports

CVE List Score used 6.5

Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

Record: CVE-2020-36721
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2020-24163 6.5

Record: EUVD-2020-24163
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x6fw-c968-rf52 6.5

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are...

Record: GHSA-x6fw-c968-rf52
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284, CWE-862
Updated: 2026-11-02

NVD 6.5

Record: CVE-2020-36721
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness: CWE-284, CWE-862
Updated: 2026-11-02

Affected products

Show 7 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36721 is a medium vulnerability (CVSS 6.5) in Colorlib Activello, published June 7, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. No source names a fixed version.