description: The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
problem types: CWE-284 Improper Access Control
affected:
{
vendor: silkalns
product: Newspaper X
versions:
version: *, status: affected, lessThanOrEqual: 1.3.1, versionType: semver
defaultStatus: unaffected
}
{
vendor: wpchill
product: Brilliance
versions:
version: *, status: affected, lessThanOrEqual: 1.2.7, versionType: semver
defaultStatus: unaffected
}
{
vendor: silkalns
product: Activello
versions:
version: *, status: affected, lessThanOrEqual: 1.4.0, versionType: semver
defaultStatus: unaffected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
]