Skip to content
Sign in
6.5 Medium

CVE-2020-36721 The…

Description

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.

Affected products and versions

Product Affected versions Fixed in
Newspaper X 1.3 earliest → 1.3.1 No fix stated
Brilliance 1.2 earliest → 1.2.7 No fix stated
Activello 1.4 earliest → 1.4.0 No fix stated

Other CVEs of Newspaper X

The 2 CVEs of Newspaper X →
CVE-2020-36708 The following themes for WordPress are vulnerable to Function Injections in versions up to and including… 9.8 Critical
Track this CVE