Access violation vulnerability in Epsilon Framework (3 themes affected)

The Brilliance, Activello, and Newspaper X themes for WordPress have a security issue that could allow an attacker to activate and deactivate plugins without permission. This is caused by a lack of security checks and nonces in the ‘inc/welcome-screen/class-activello-welcome.php’ file, which contains the ‘activello_activate_plugin’ and ‘activello_deactivate_plugin’ functions. This vulnerability affects versions of the themes up to and including Brilliance 1.2.7, Activello 1.4.0, and Newspaper X 1.3.1.