AccessPress Themes Vulnerabilities and Affected Products
Vulnerabilities associated with VMag.
Products
Clear product- Access Demo Importer (WordPress plugin)2 vulnerabilities
- Bingle2 vulnerabilities
- Bloger2 vulnerabilities
- Doko2 vulnerabilities
- Enlighten2 vulnerabilities
- FotoGraphy2 vulnerabilities
- ParallaxSome2 vulnerabilities
- Punte2 vulnerabilities
- Revolve2 vulnerabilities
- Ripple2 vulnerabilities
- ScrollMe2 vulnerabilities
- Social Auto Poster2 vulnerabilities
- StoreVilla2 vulnerabilities
- VMag2 vulnerabilities
- WP TFeed2 vulnerabilities
- Access Demo Importer1 vulnerability
- accessbuddy1 vulnerability
- Accesspress Basic1 vulnerability
- AccessPress Custom CSS1 vulnerability
- AccessPress Custom Post Type1 vulnerability
- AccessPress iFeeds1 vulnerability
- Accesspress Lite1 vulnerability
- Accesspress Mag1 vulnerability
- AccessPress Parallax1 vulnerability
- AccessPress Root1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-24867CRITICAL | Backdoored Plugins & Themes from AccessPress ThemesNumerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion CWE-912Feb 21, 2022 | CVSS9.8v3.1 | EPSS18.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-39317HIGH | AccessPress Themes - Authenticated Malicious File UploadA WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1… | CVSS8.8v3.1 | EPSS1.71% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |