CVE-2020-36708
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary PHP functions via the epsilon_framework_ajax_action in vulnerable WordPress themes, leading to remote code execution. It affects multiple WordPress themes using the Epsilon Framework. Anyone running affected theme versions is vulnerable.
💻 Affected Systems
- Shapely
- NewsMag
- Activello
- Illdy
- Allegiant
- Newspaper X
- Pixova Lite
- Brilliance
- MedZone Lite
- Regina Lite
- Transcend
- Affluent
- Bonkers
- Antreas
- Sparkling
- NatureMag Lite
📦 What is this software?
Activello by Colorlib
Affluent by Cpothemes
Allegiant by Cpothemes
Antreas by Machothemes
Bonkers by Colorlib
Brilliance by Cpothemes
Illdy by Colorlib
Medzone Lite by Machothemes
Naturemag Lite by Machothemes
Newsmag by Machothemes
Newspaper X by Colorlib
Pixova Lite by Colorlib
Regina Lite by Machothemes
Shapely by Colorlib
Sparklinkg by Colorlib
Transcend by Cpothemes
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the WordPress site, installing backdoors, stealing data, and using the server for further attacks.
Likely Case
Website defacement, malware injection, credential theft, and use as part of botnets or for cryptocurrency mining.
If Mitigated
Limited impact if proper web application firewalls, file integrity monitoring, and least privilege principles are implemented.
🎯 Exploit Status
Exploits are publicly available and have been used in large-scale attacks. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest versions of each theme (check individual theme changelogs)
Vendor Advisory: https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Check for updates on affected themes. 4. Update all vulnerable themes to latest versions. 5. Verify updates completed successfully.
🔧 Temporary Workarounds
Disable vulnerable themes
allSwitch to a non-vulnerable theme until patches can be applied
wp theme activate twentytwentyone
wp theme delete [vulnerable-theme-name]
Web Application Firewall rule
linuxBlock requests to epsilon_framework_ajax_action endpoint
LocationMatch "\/wp-admin\/admin-ajax\.php"
SetEnvIf Request_URI "epsilon_framework_ajax_action" block_epsilon
Deny from env=block_epsilon
🧯 If You Can't Patch
- Implement strict web application firewall rules blocking suspicious PHP function calls
- Enable file integrity monitoring to detect unauthorized file changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress theme versions in Appearance > Themes or use: wp theme list --fields=name,status,versionCheck Version:
wp theme list --fields=name,versionVerify Fix Applied:
Verify theme versions are above vulnerable ranges and test admin-ajax.php endpoint for epsilon_framework_ajax_action📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with epsilon_framework_ajax_action parameter
- Unusual PHP function calls in web server logs
- File creation/modification in wp-content directory
Network Indicators:
- HTTP POST requests containing eval(), system(), exec() or similar functions in parameters
- Traffic patterns matching known exploit payloads
SIEM Query:
source="web_logs" AND uri_path="/wp-admin/admin-ajax.php" AND (param="epsilon_framework_ajax_action" OR param CONTAINS "eval" OR param CONTAINS "system")🔗 References
- https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
- https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-in-wordpress-sparkling-theme/
- https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5
- https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=cve
- https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/
- https://blog.nintechnet.com/unauthenticated-function-injection-vulnerability-in-wordpress-sparkling-theme/
- https://wpscan.com/vulnerability/bec52a5b-c892-4763-a962-05da7100eca5
- https://www.wordfence.com/blog/2020/11/large-scale-attacks-target-epsilon-framework-themes/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=cve
