CVE-2020-36721: colorlib activello Missing Authorization
Vulnerability summary
CVE-2020-36721 is a medium (CVSS 6.5) Missing Authorization vulnerability in colorlib activello. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.3% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.4.2.
Timeline
- 07-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- wordfenceSource6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.97%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
0.00 pp
From 0.97% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Machothemes5 products
- antreas< 1.0.7
- medzone_lite< 1.2.6
- naturemag_lite≤ 1.0.4
- newsmag< 2.4.2
- regina_lite< 2.0.6
Cpothemes4 products
- affluent< 1.1.2
- allegiant< 1.2.6
- brilliance< 1.3.0
- transcend< 1.2.0
Wordpress3 products
- activello≤ 1.4.0 (fixed in 1.4.2)
- brilliance≤ 1.2.7 (fixed in 1.3.0)
- newspaper-x≤ 1.3.1 (fixed in 1.3.2)
Silkalns2 products
- activello≤ 1.4.0
- newspaper x≤ 1.3.1
Wpchill1 product
- brilliance≤ 1.2.7
6 vendors · 21 products
References
6 links- blog.nintechnet.com/unauthenticated-function-injection-vulnerability-fixed-in-15-wordpress-themes/ExploitThird Party Advisory