vendor:
Epsilon Framework
by:
gx1, lotar
9
CVSS
CRITICAL
Unauthenticated Function Injection
Function Injection
CWE
Product Name: Epsilon Framework
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE:
CPE: a:wordpress:wordpress
Platforms Tested: Wordpress
2020
WordPress Epsilon Framework Multiple Themes – Unauthenticated Function Injection
Fifteen WordPress themes use a vulnerable version of epsilon-framework that is vulnerable to a critical unauthenticated function injection vulnerability, due to the lack of capability and CSRF nonce checks in AJAX actions.
Mitigation:
Update affected themes to the fixed versions.