{"id":"CVE-2020-36721","aliases":["EUVD-2020-24163","GHSA-x6fw-c968-rf52"],"status":"published","title":"Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation","description":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00971,"percentile":0.62209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-862"],"published":"2023-06-07T01:51:37Z","modified":"2026-06-17T03:16:03Z","products":[{"vendor":"colorlib","product":"activello"},{"vendor":"colorlib","product":"bonkers"},{"vendor":"colorlib","product":"illdy"},{"vendor":"colorlib","product":"newspaper_x"},{"vendor":"colorlib","product":"pixova_lite"},{"vendor":"colorlib","product":"shapely"},{"vendor":"cpothemes","product":"affluent"},{"vendor":"cpothemes","product":"allegiant"},{"vendor":"cpothemes","product":"brilliance"},{"vendor":"cpothemes","product":"transcend"},{"vendor":"machothemes","product":"antreas"},{"vendor":"machothemes","product":"medzone_lite"},{"vendor":"machothemes","product":"naturemag_lite"},{"vendor":"machothemes","product":"newsmag"},{"vendor":"machothemes","product":"regina_lite"},{"vendor":"silkalns","product":"activello"},{"vendor":"silkalns","product":"newspaper x"},{"vendor":"wp chill","product":"brilliance"},{"vendor":"wpchill","product":"brilliance"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wordpress.org/themes/activello/","tags":["x_transferred","Product"]},{"url":"https://wordpress.org/themes/newspaper-x/","tags":["x_transferred","Product"]},{"url":"https://wordpress.org/themes/brilliance/","tags":["x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36721"},{"url":"https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes"},{"url":"https://wordpress.org/themes/activello"},{"url":"https://wordpress.org/themes/brilliance"},{"url":"https://wordpress.org/themes/newspaper-x"},{"url":"https://github.com/advisories/GHSA-x6fw-c968-rf52"}],"sources":{"cve":[{"id":"CVE-2020-36721","title":"Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation","description":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.","status":"published","published":"2023-06-07T01:51:37.465Z","modified":"2026-04-08T17:14:14.374Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-24163","description":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.","status":"published","published":"2023-06-07T01:51:37Z","modified":"2026-04-08T17:14:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:45.916022Z"}],"ghsa":[{"id":"GHSA-x6fw-c968-rf52","title":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are...","description":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.","status":"published","published":"2023-06-07T03:30:22Z","modified":"2024-04-04T04:37:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:56:25.511354Z"}],"nvd":[{"id":"CVE-2020-36721","description":"The Brilliance \u003c= 1.2.7, Activello \u003c= 1.4.0, and Newspaper X \u003c= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.","status":"published","published":"2023-06-07T02:15:12.297Z","modified":"2026-06-17T03:16:03.293Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T14:06:47.910346Z"}]}}