CVE-2020-36721
Medium
Description
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Colorlib Activello
PublishedJun 7, 2023
First seenJun 7, 2023
Weakness typeCWE-284Improper access control
How to fix
Update
- colorlib activello1.4.2 or later
- colorlib bonkers1.0.6 or later
- colorlib illdy2.1.7 or later
- colorlib newspaper_x1.3.2 or later
- colorlib pixova_lite2.0.7 or later
- colorlib shapely1.2.9 or later
- cpothemes affluent1.1.2 or later
- cpothemes allegiant1.2.6 or later
- cpothemes brilliance1.3.0 or later
- cpothemes transcend1.2.0 or later
- machothemes antreas1.0.7 or later
- machothemes medzone_lite1.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| colorlib activello | v < 1.4.2 | 1.4.2 |
| colorlib bonkers | v < 1.0.6 | 1.0.6 |
| colorlib illdy | v < 2.1.7 | 2.1.7 |
| colorlib newspaper_x | v < 1.3.2 | 1.3.2 |
| colorlib pixova_lite | v < 2.0.7 | 2.0.7 |
| colorlib shapely | v < 1.2.9 | 1.2.9 |
| cpothemes affluent | v < 1.1.2 | 1.1.2 |
| cpothemes allegiant | v < 1.2.6 | 1.2.6 |
| cpothemes brilliance | v < 1.3.0 | 1.3.0 |
| cpothemes transcend | v < 1.2.0 | 1.2.0 |
| machothemes antreas | v < 1.0.7 | 1.0.7 |
| machothemes medzone_lite | v < 1.2.6 | 1.2.6 |
| machothemes naturemag_lite | v ≤ 1.0.4 | — |
| machothemes newsmag | v < 2.4.2 | 2.4.2 |
| machothemes regina_lite | v < 2.0.6 | 2.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.