CVE-2020-35313: WonderCMS theme/plugin installer SSRF leading to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no privileges or interaction required, public exploit references, and a high EPSS score make this an urgent patch target despite the absence of KEV listing.

What it is

The addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 performs server-side requests against an attacker-supplied URL without adequate validation. Because the fetched content is installed as a theme or plugin, the SSRF can be chained into arbitrary code execution on the server. The flaw is rated critical (CVSS 3.1 9.8) and public exploit write-ups exist.

Impact

An attacker can make the server fetch attacker-controlled content and have it installed as a theme or plugin, resulting in arbitrary code execution with the web server's privileges. This gives full compromise of the CMS host, including data theft and use as a pivot point.

Attack surface

Reached remotely over the network through the theme/plugin installer endpoint in index.php; the CVSS vector indicates no privileges (PR:N) and no user interaction (UI:N) are required. Note that one public write-up is titled as authenticated RCE/SSRF, so the record contains conflicting signals about whether authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.452 probability, 98.7th percentile) and multiple references are tagged Exploit, including Packet Storm and a technical write-up, indicating public exploit code and detail are available.

What to do

• Upgrade WonderCMS to a version later than 3.1.3 that fixes the addCustomThemePluginRepository SSRF; verify the fix in the vendor repository before deploying.
• If upgrade is not immediately possible, restrict or disable the custom theme/plugin repository install feature and remove write access to the themes and plugins directories.
• Block outbound HTTP/HTTPS from the web server to untrusted hosts using egress firewall rules or a proxy allowlist.
• Run the CMS with least privilege and disable PHP execution in upload/theme/plugin directories where feasible.
• Restrict access to the admin installer interface by IP allowlist or place it behind authentication and network controls.

Detection

• Monitor web server and PHP logs for requests to index.php that invoke the theme/plugin installer with external URLs, especially unusual domains or IP literals.
• Alert on outbound HTTP requests originating from the web server process to unexpected destinations.
• Watch for new or modified files in the themes and plugins directories and for unexpected PHP files appearing there.
• Correlate installer endpoint access with subsequent process execution or file writes on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.