Log in Start free

Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence

CVE-2020-36708Epsilon Framework Themes (Various Versions) - Function Injection

Critical 9.8

In plain English

A critical-severity code injection in Antreas from machothemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 65.3% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)65.3%top 0.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

Affected products (as reported)

VendorProductVersions
machothemes Antreas 0 – through 1.0.2
machothemes NatureMag Lite 0 – through 1.0.4
silkalns Bonkers 0 – through 1.0.4
wpchill Affluent 0 – through 1.1.0
wpchill Transcend 0 – through 1.1.8
wpchill Allegiant 0 – through 1.2.2
machothemes MedZone Lite 0 – through 1.2.4
silkalns Shapely 0 – through 1.2.7
wpchill Brilliance 0 – through 1.2.7
silkalns Newspaper X 0 – through 1.3.1
silkalns Activello 0 – through 1.4.0
machothemes Regina Lite 0 – through 2.0.4
silkalns Pixova Lite 0 – through 2.0.5
silkalns Illdy 0 – through 2.1.4
machothemes NewsMag 0 – through 2.4.1
silkalns Sparkling 0 – through 2.4.8

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References