CVE-2020-36708: Unauthenticated function injection in Epsilon Framework WordPress themes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and very high EPSS make this an urgent remote code execution risk for any site running an affected theme.

What it is

Multiple WordPress themes built on the Epsilon Framework expose the epsilon_framework_ajax_action handler, which allows arbitrary function calls. Versions up to and including Shapely 1.2.7, NewsMag 2.4.1, Activello 1.4.0, Illdy 2.1.4, Allegiant 1.2.2, Newspaper X 1.3.1, Pixova Lite 2.0.5, Brilliance 1.2.7, MedZone Lite 1.2.4, Regina Lite 2.0.4, Transcend 1.1.8, Affluent 1.1.0, Bonkers 1.0.4, Antreas 1.0.2, Sparkling 2.4.8 and NatureMag Lite 1.0.4 are affected. Because the flaw is reachable without authentication, any site running an unpatched theme is at risk of full compromise.

Impact

An unauthenticated attacker can invoke arbitrary PHP functions and achieve remote code execution on the web server. This typically leads to full site takeover, data theft, and use of the host for further attacks.

Attack surface

The vulnerability is reached over the network through the theme's AJAX action (epsilon_framework_ajax_action); no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit write-ups exist (references tagged Exploit), and EPSS is 0.653 with a 99.2 percentile, indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Update each affected theme to a version above the listed vulnerable release; if no fixed version is available for a theme, remove or replace it.
• If immediate patching is not possible, disable the affected theme and switch to a maintained alternative.
• Block or restrict access to admin-ajax.php actions associated with epsilon_framework_ajax_action at the WAF or reverse proxy where feasible.
• Audit sites for the listed themes and treat any unpatched instance as compromised until proven otherwise.
• Apply virtual patching or request filtering for the vulnerable AJAX endpoint until themes are updated.

Detection

• Monitor web logs for POST requests to /wp-admin/admin-ajax.php with action parameters referencing epsilon_framework_ajax_action.
• Look for unexpected outbound connections, new admin users, or modified theme/plugin files on hosts running the affected themes.
• Search for known exploit payload patterns in HTTP request bodies targeting the Epsilon Framework AJAX handler.
• Review PHP error logs and process execution for unusual function calls or command execution originating from the web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.