CVE-2020-36721

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.

• colorlib activello (< 1.4.2) • colorlib bonkers (< 1.0.6) • colorlib illdy (< 2.1.7) • colorlib newspaper x (< 1.3.2) • colorlib pixova lite (< 2.0.7) • colorlib shapely (< 1.2.9) • cpothemes affluent (< 1.1.2) • cpothemes allegiant (< 1.2.6) • cpothemes brilliance (< 1.3.0) • cpothemes transcend (< 1.2.0) • machothemes antreas (< 1.0.7) • machothemes medzone lite (< 1.2.6) • machothemes naturemag lite (<= 1.0.4) • machothemes newsmag (< 2.4.2) • machothemes regina lite (< 2.0.6)