CVE-2020-36708

Published: Jun 7, 2023

Modified: Apr 8, 2026

PUBLISHED

CVSS v3.1

9.8

CRITICAL

Description

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

Vendor	Product	Versions
machothemes	Antreas	affected `0 - <= 1.0.2`
machothemes	NatureMag Lite	affected `0 - <= 1.0.4`
silkalns	Bonkers	affected `0 - <= 1.0.4`
wpchill	Affluent	affected `0 - <= 1.1.0`
wpchill	Transcend	affected `0 - <= 1.1.8`
wpchill	Allegiant	affected `0 - <= 1.2.2`
machothemes	MedZone Lite	affected `0 - <= 1.2.4`
silkalns	Shapely	affected `0 - <= 1.2.7`
wpchill	Brilliance	affected `0 - <= 1.2.7`
silkalns	Newspaper X	affected `0 - <= 1.3.1`
silkalns	Activello	affected `0 - <= 1.4.0`
machothemes	Regina Lite	affected `0 - <= 2.0.4`
silkalns	Pixova Lite	affected `0 - <= 2.0.5`
silkalns	Illdy	affected `0 - <= 2.1.4`
machothemes	NewsMag	affected `0 - <= 2.4.1`
silkalns	Sparkling	affected `0 - <= 2.4.8`