CVE-2020-36708

CRITICALNuclei

Epsilon Framework Themes (Various Versions) - Function Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-36708 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 7, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 26, 2024 · Source: CVE List

Affected products and versions

Showing 12 of 17
ProductSourceVersion range

activello

Browse colorlib / activello
VulnCheckVersion data not supplied

Antreas

Browse machothemes / Antreas

Default status: unaffected

CVE ListThrough 1.0.2affected

MedZone Lite

Browse machothemes / MedZone Lite

Default status: unaffected

CVE ListThrough 1.2.4affected

NatureMag Lite

Browse machothemes / NatureMag Lite

Default status: unaffected

CVE ListThrough 1.0.4affected

NewsMag

Browse machothemes / NewsMag

Default status: unaffected

CVE ListThrough 2.4.1affected

Regina Lite

Browse machothemes / Regina Lite

Default status: unaffected

CVE ListThrough 2.0.4affected

Activello

Browse silkalns / Activello

Default status: unaffected

CVE ListThrough 1.4.0affected

Bonkers

Browse silkalns / Bonkers

Default status: unaffected

CVE ListThrough 1.0.4affected

Illdy

Browse silkalns / Illdy

Default status: unaffected

CVE ListThrough 2.1.4affected

Newspaper X

Browse silkalns / Newspaper X

Default status: unaffected

CVE ListThrough 1.3.1affected

Pixova Lite

Browse silkalns / Pixova Lite

Default status: unaffected

CVE ListThrough 2.0.5affected

Shapely

Browse silkalns / Shapely

Default status: unaffected

CVE ListThrough 1.2.7affected

Proofs of concept

1

Repository PoCs

GitHubb1g-b33f/CVE-2020-36708Repository PoCby b1g-b33f2Scanner2 files

1.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action AJAX handler, confirming the presence of CVE-2020-36708 without executing a payload on the target.

Backdoor review

No backdoor observed in reviewed code

The artifact contains a shell script PoC for CVE-2020-36708 and a README. The script sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareWordPressEpsilon Framework
Attack typesssrffunction injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends a single HTTP request designed to cause the target server to make an outbound connection to a user-supplied domain. It does not deliver a payload, establish a shell, or perform any action on the target beyond triggering the vulnerable function. The README explicitly describes this as a non-destructive SSRF demonstration to confirm arbitrary function execution.

README.md:13CVE-2020-36708.sh:6-13

Requirements

  • Target WordPress site running a vulnerable version of a theme using the Epsilon Framework.README.md:4
  • A collaborator or webhook domain to receive the outbound request.CVE-2020-36708.sh:4

Observed behavior

  • Prompts the user for a target domain and a collaborator domain.CVE-2020-36708.sh:3-4
  • Sends a POST request to /wp-admin/admin-ajax.php with payload withheld and parameters that invoke the Requests::request_multiple method to make the server fetch a URL on the collaborator domain.CVE-2020-36708.sh:6-13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget endpoint for the CVE-2020-36708 exploitCVE-2020-36708.sh:6
Parameter
Payload withheldVulnerable AJAX action used to trigger function injectionCVE-2020-36708.sh:8
Parameter
Payload withheldClass and method invoked via the vulnerabilityCVE-2020-36708.sh:9-10
Url
Payload withheldCollaborator/webhook URL used to confirm SSRFCVE-2020-36708.sh:11
Review boundaries

What the analysis did not establish

  • Only the supplied text files were analyzed; no binary or opaque content was present.
  • The script's behavior is inferred from static analysis of the source code; it was not executed.
  • Only the two text files (CVE-2020-36708.sh and README.md) were reviewed; no other files exist in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Epsilon Framework Themes <=2.4.8 - Remote Code ExecutionCVSS 9.8

WordPress themes including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4 contain a function injection caused by epsilon_framework_ajax_action, letting unauthenticated attackers call functions and achieve remote code execution, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary code remotely, leading to full site compromise.

Remediation

Update themes to the latest versions where the vulnerability is fixed or apply security patches provided by theme developers.

WeaknessesCWE-94
Authorsmadrobot
Template tagswordpressrcecvecve2020edbwpscanvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:colorlib:activello:*:*:*:*:*:wordpress:*:*
https://www.exploit-db.com/exploits/49327 https://wpscan.com/vulnerability/10417 https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5 https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/ https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=cve https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/

Source: ProjectDiscovery

References

6