9.8
Critical
CVE-2020-36708 The following themes for WordPress are vulnerable to Function Injections in versions up to and including…
Description
The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Allegiant 1.2 | earliest → 1.2.2 | No fix stated |
| NatureMag Lite 1.0 | earliest → 1.0.4 | No fix stated |
| NewsMag 2.4 | earliest → 2.4.1 | No fix stated |
| Shapely 1.2 | earliest → 1.2.7 | No fix stated |
| Bonkers 1.0 | earliest → 1.0.4 | No fix stated |
| Regina Lite 2.0 | earliest → 2.0.4 | No fix stated |
| Transcend 1.1 | earliest → 1.1.8 | No fix stated |
| Sparkling 2.4 | earliest → 2.4.8 | No fix stated |
| Newspaper X 1.3 | earliest → 1.3.1 | No fix stated |
Show the 7 other branches Hide the 7 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Antreas 1.0 | earliest → 1.0.2 | No fix stated |
| Affluent 1.1 | earliest → 1.1.0 | No fix stated |
| Brilliance 1.2 | earliest → 1.2.7 | No fix stated |
| Activello 1.4 | earliest → 1.4.0 | No fix stated |
| Illdy 2.1 | earliest → 2.1.4 | No fix stated |
| MedZone Lite 1.2 | earliest → 1.2.4 | No fix stated |
| Pixova Lite 2.0 | earliest → 2.0.5 | No fix stated |