Lucene search

[email protected]CVE-2021-24867

HistoryFeb 21, 2022 - 11:15 a.m.

CVE-2021-24867

2022-02-2111:15:00

CWE-912

[email protected]

web.nvd.nist.gov

128

cve-2021-24867

accesspress themes

access keys

backdoor

website compromise

plugins

themes

wordpress

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.2%

JSON

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

CPENameOperatorVersion
accesspressthemes:accessbuddyaccesspressthemes accessbuddyeq1.0.0
accesspressthemes:accesspress_basicaccesspressthemes accesspress basiceq3.2.1
accesspressthemes:accesspress_liteaccesspressthemes accesspress liteeq2.92
accesspressthemes:accesspress_magaccesspressthemes accesspress mageq2.6.5
accesspressthemes:accesspress_parallaxaccesspressthemes accesspress parallaxeq4.5
accesspressthemes:accesspress_rayaccesspressthemes accesspress rayeq1.19.5
accesspressthemes:accesspress_rootaccesspressthemes accesspress rooteq2.5
accesspressthemes:accesspress_stapleaccesspressthemes accesspress stapleeq1.9.1
accesspressthemes:accesspress_storeaccesspressthemes accesspress storeeq2.4.9
accesspressthemes:agency_liteaccesspressthemes agency liteeq1.1.6

CPE	Name	Operator	Version
accesspressthemes:accessbuddy	accesspressthemes accessbuddy	eq	1.0.0
accesspressthemes:accesspress_basic	accesspressthemes accesspress basic	eq	3.2.1
accesspressthemes:accesspress_lite	accesspressthemes accesspress lite	eq	2.92
accesspressthemes:accesspress_mag	accesspressthemes accesspress mag	eq	2.6.5
accesspressthemes:accesspress_parallax	accesspressthemes accesspress parallax	eq	4.5
accesspressthemes:accesspress_ray	accesspressthemes accesspress ray	eq	1.19.5
accesspressthemes:accesspress_root	accesspressthemes accesspress root	eq	2.5
accesspressthemes:accesspress_staple	accesspressthemes accesspress staple	eq	1.9.1
accesspressthemes:accesspress_store	accesspressthemes accesspress store	eq	2.4.9
accesspressthemes:agency_lite	accesspressthemes agency lite	eq	1.1.6

Rows per page:

1-10 of 931

References

jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/

wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.2%

JSON

Related for CVE-2021-24867

checkpoint_advisories1 prion1 cnvd1 wpvulndb1 talosblog1 osv1 thn1