CVE-2020-35945: An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPres
61
This week
CRITICAL 9.9UPGRADEUPGRADEUPGRADE
CVE-2020-35945 is a critical-severity flaw (CVSS 9.9) affecting divi, divi builder, extra. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
elegantthemes extra UPGRADE
Affected: >= 2.0 and < 4.5.3
Fixed in: 4.5.3
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy extra || rpm -q extra || extra --version
2. UPGRADE to 4.5.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade extra
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade extra
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison extra
sudo apt install extra=<VERSION_BEFORE_2.0>
sudo apt-mark hold extra
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list extra
sudo dnf downgrade extra-<VERSION_BEFORE_2.0>
sudo dnf versionlock add extra
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-35945?
divi: upgrade to 4.5.3; divi builder: upgrade to 4.5.3; extra: upgrade to 4.5.3. Exact commands for each OS are on this page.
Is CVE-2020-35945 being exploited?
CVE-2020-35945 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-35945 affect?
CVE-2020-35945 affects divi, divi builder, extra. Severity is critical (CVSS 9.9). An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This o
How urgent is CVE-2020-35945?
Priority 61/100. Critical severity; Public exploit reference
PatchTheCVE