CVE-2021-39317
published 2021-10-11CVE-2021-39317: A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX…
PriorityP276high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.65%
73.6th percentile
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
Affected
82 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| accesspress_themes | access_demo_importer | 1.0.6 – 1.0.6 | — |
| accesspress_themes | accesspress-basic | 3.2.1 – 3.2.1 | — |
| accesspress_themes | accesspress-lite | 2.9.2 – 2.9.2 | — |
| accesspress_themes | accesspress-mag | 2.6.5 – 2.6.5 | — |
| accesspress_themes | accesspress-parallax | 4.5 – 4.5 | — |
| accesspress_themes | accesspress-root | 2.5 – 2.5 | — |
| accesspress_themes | accesspress-store | 2.4.9 – 2.4.9 | — |
| accesspress_themes | agency-lite | 1.1.6 – 1.1.6 | — |
| accesspress_themes | arrival | 1.4.2 – 1.4.2 | — |
| accesspress_themes | bingle | 1.0.4 – 1.0.4 | — |
| accesspress_themes | bloger | 1.2.6 – 1.2.6 | — |
| accesspress_themes | brovy | 1.3 – 1.3 | — |
| accesspress_themes | construction-lite | 1.2.5 – 1.2.5 | — |
| accesspress_themes | doko | 1.0.27 – 1.0.27 | — |
| accesspress_themes | edict-lite | 1.1.4 – 1.1.4 | — |
| accesspress_themes | enlighten | 1.3.5 – 1.3.5 | — |
| accesspress_themes | fotography | 2.4.0 – 2.4.0 | — |
| accesspress_themes | opstore | 1.4.3 – 1.4.3 | — |
| accesspress_themes | parallaxsome | 1.3.6 – 1.3.6 | — |
| accesspress_themes | punte | 1.1.2 – 1.1.2 | — |
| accesspress_themes | revolve | 1.3.1 – 1.3.1 | — |
| accesspress_themes | ripple | 1.2.0 – 1.2.0 | — |
| accesspress_themes | sakala | 1.0.4 – 1.0.4 | — |
| accesspress_themes | scrollme | 2.1.0 – 2.1.0 | — |
| accesspress_themes | storevilla | 1.4.1 – 1.4.1 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-737m-cr75-9hw3: Versions up to, and including, 1
ghsa_unreviewed·2022-05-24
CVE-2021-39317 [HIGH] CWE-285 GHSA-737m-cr75-9hw3: Versions up to, and including, 1
Versions up to, and including, 1.0.6, of the Access Demo Importer WordPress plugin are vulnerable to arbitrary file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the ~/inc/demo-functions.php.
VulnCheck
accesspressthemes access_demo_importer Improper Authorization
vulncheck·2021·CVSS 8.8
CVE-2021-39317 [HIGH] accesspressthemes access_demo_importer Improper Authorization
accesspressthemes access_demo_importer Improper Authorization
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.phphttps://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.phphttps://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.phphttps://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.phphttps://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/
2021-10-11
Published
Exploited in the wild