Test ID:	1.3.6.1.4.1.25623.1.0.112841
Category:	Web application abuses
Title:	RCE Vulnerability in WordPress Themes using the Epsilon Framework
Summary:	Multiple WordPress themes using the Epsilon Framework are prone; to a function injection vulnerability that could lead to remote code execution (RCE).
Description:	Summary: Multiple WordPress themes using the Epsilon Framework are prone to a function injection vulnerability that could lead to remote code execution (RCE). Vulnerability Insight: The attacker uses POST requests to admin-ajax.php and as such the attack does not leave distinct log entries. Vulnerability Impact: Full remote code execution (RCE) leading to site takeover is possible. Affected Software/OS: The following WordPress themes are known to be affected: - Shapely <= 1.2.7 - NewsMag <= 2.4.1 - Activello <= 1.4.0 - Illdy <= 2.1.4 - Allegiant <= 1.2.2 - Newspaper X <= 1.3.1 - Pixova Lite <= 2.0.5 - Brilliance <= 1.2.7 - MedZone Lite <= 1.2.4 - Regina Lite <= 2.0.4 - Transcend <= 1.1.8 - Affluent <= 1.1.0 - Bonkers <= 1.0.4 - Antreas <= 1.0.2 - NatureMag Lite <= 1.0.5 (NOTE: This theme is not available anymore) Solution: Please contact the vendor for additional information regarding potential updates. If none exist remove the theme. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.