Skip to content
Fencer Vulns
critical 9.8

CVE-2020-36708 in the critical feed json

Epsilon Framework Themes (Various Versions) - Function Injection

published 2023-06-07 3 y ago modified 2026-06-17 4 mo ago also EUVD-2020-24150

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
65.3%
EPSS 65.3% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known, plus a Nuclei check

Summary

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

Patch / fix

  • colorlib activello 1.4.2
  • colorlib bonkers 1.0.6
  • colorlib illdy 2.1.7
  • colorlib newspaper_x 1.3.2
  • colorlib pixova_lite 2.0.7
  • colorlib shapely 1.2.9
  • cpothemes affluent 1.1.2
  • cpothemes allegiant 1.2.6
  • cpothemes brilliance 1.3.0
  • cpothemes transcend 1.2.0
  • machothemes antreas 1.0.7
  • machothemes medzone_lite 1.2.6
  • machothemes newsmag 2.4.2
  • machothemes regina_lite 2.0.6

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
22 mo ago

Exploit prediction

65.34% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution nuclei detection template
  • blog.nintechnet.com https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/ referenced PoC, tagged "exploit" by a source, unverified
  • blog.nintechnet.com https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-in-wordpress-sparkling-theme/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • machothemes Antreas
  • machothemes NatureMag Lite
  • silkalns Bonkers
  • wpchill Affluent
  • wpchill Transcend
  • wpchill Allegiant
  • machothemes MedZone Lite
  • silkalns Shapely
  • wpchill Brilliance
  • silkalns Newspaper X
  • silkalns Activello
  • machothemes Regina Lite
  • silkalns Pixova Lite
  • silkalns Illdy
  • machothemes NewsMag
  • silkalns Sparkling

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.