Epsilon Framework Themes (Various Versions) - Function Injection
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- machothemes Antreas
through 1.0.2
- machothemes NatureMag Lite
through 1.0.4
- silkalns Bonkers
through 1.0.4
- wpchill Affluent
through 1.1.0
- wpchill Transcend
through 1.1.8
- wpchill Allegiant
through 1.2.2
- machothemes MedZone Lite
through 1.2.4
- silkalns Shapely
through 1.2.7
- wpchill Brilliance
through 1.2.7
- silkalns Newspaper X
through 1.3.1
- silkalns Activello
through 1.4.0
- machothemes Regina Lite
through 2.0.4
- silkalns Pixova Lite
through 2.0.5
- silkalns Illdy
through 2.1.4
- machothemes NewsMag
through 2.4.1
- silkalns Sparkling
through 2.4.8