CVE-2021-39317

🗓️ 11 Oct 2021 15:48:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 106 Views🌐 WEB

WordPress plugin and themes by AccessPress Themes vulnerable to file upload via plugin_offline_installer AJAX action

Reporter	Title	Published	Views	Family All 55
Circl	CVE-2021-39317	11 Oct 202120:24	–	circl
CNNVD	WordPress 代码问题漏洞	11 Oct 202100:00	–	cnnvd
Cvelist	CVE-2021-39317 AccessPress Themes - Authenticated Malicious File Upload	11 Oct 202115:48	–	cvelist
EUVD	EUVD-2021-25678	7 Oct 202500:30	–	euvd
NVD	CVE-2021-39317	11 Oct 202116:15	–	nvd
Patchstack	WordPress ScrollMe theme <= 2.1.0 - Arbitrary File Upload vulnerability	28 Nov 202100:00	–	patchstack
Patchstack	WordPress AccessPress Root theme <= 2.5 - Arbitrary File Upload vulnerability	28 Nov 202100:00	–	patchstack
Patchstack	WordPress Edict Lite theme <= 1.1.4 - Arbitrary File Upload vulnerability	24 Dec 202100:00	–	patchstack
Patchstack	WordPress Opstore theme <= 1.4.3 - Arbitrary File Upload vulnerability	24 Dec 202100:00	–	patchstack
Patchstack	WordPress Eight Sec theme <= 1.1.4 - Arbitrary File Upload vulnerability	24 Dec 202100:00	–	patchstack

NVD

Vulners

Node

accesspressthemes access_demo_importerRange<1.0.7wordpress

accesspressthemes accesspress-liteRange≤2.92wordpress

accesspressthemes accesspress-magRange≤2.6.5wordpress

accesspressthemes accesspress-parallaxRange≤4.5wordpress

accesspressthemes accesspress-rootRange≤2.5wordpress

accesspressthemes accesspress-storeRange≤2.4.9wordpress

accesspressthemes accesspress_basicRange≤3.2.1wordpress

accesspressthemes agency-liteRange≤1.1.6wordpress

accesspressthemes arrivalRange≤1.4.2wordpress

accesspressthemes bingleRange≤1.0.4wordpress

accesspressthemes blogerRange≤1.2.6wordpress

accesspressthemes brovyRange≤1.3wordpress

accesspressthemes construction-liteRange≤1.2.5wordpress

accesspressthemes dokoRange≤1.0.27wordpress

accesspressthemes edict-liteRange≤1.1.4wordpress

accesspressthemes eight-secRange≤1.1.4wordpress

accesspressthemes eightlaw-liteRange≤2.1.5wordpress

accesspressthemes eightmedi-liteRange≤2.1.8wordpress

accesspressthemes eightstore-liteRange≤1.2.5wordpress

accesspressthemes enlightenRange≤1.3.5wordpress

accesspressthemes fotographyRange≤2.4.0wordpress

accesspressthemes opstoreRange≤1.4.3wordpress

accesspressthemes parallaxsomeRange≤1.3.6wordpress

accesspressthemes punteRange≤1.1.2wordpress

accesspressthemes revolveRange≤1.3.1wordpress

accesspressthemes rippleRange≤1.2.0wordpress

accesspressthemes sakalaRange≤1.0.4wordpress

accesspressthemes scrollmeRange≤2.1.0wordpress

accesspressthemes storevillaRange≤1.4.1wordpress

accesspressthemes swing-liteRange≤1.1.9wordpress

accesspressthemes the-launcherRange≤1.3.2wordpress

accesspressthemes the-mondayRange≤1.4.1wordpress

accesspressthemes the100Range≤1.1.2wordpress

accesspressthemes ultra-sevenRange≤1.2.8wordpress

accesspressthemes uncode-liteRange≤1.3.3wordpress

accesspressthemes vmagRange≤1.2.7wordpress

accesspressthemes vmagazine-liteRange≤1.3.5wordpress

accesspressthemes vmagazine-newsRange≤1.0.5wordpress

accesspressthemes wp-storeRange≤1.1.9wordpress

accesspressthemes wpparallaxRange≤2.0.6wordpress

accesspressthemes zigcy-babyRange≤1.0.6wordpress

accesspressthemes zigcy-cosmeticsRange≤1.0.5wordpress

accesspressthemes zigcy-liteRange≤2.0.9wordpress

[
  {
    "product": "Access Demo Importer",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.6",
        "status": "affected",
        "version": "1.0.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-basic",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "3.2.1",
        "status": "affected",
        "version": "3.2.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.9.2",
        "status": "affected",
        "version": "2.9.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-mag",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.6.5",
        "status": "affected",
        "version": "2.6.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-parallax",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "4.5",
        "status": "affected",
        "version": "4.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-root",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.5",
        "status": "affected",
        "version": "2.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "accesspress-store",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.4.9",
        "status": "affected",
        "version": "2.4.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "agency-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.6",
        "status": "affected",
        "version": "1.1.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "arrival",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.4.2",
        "status": "affected",
        "version": "1.4.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "bingle",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.4",
        "status": "affected",
        "version": "1.0.4",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "bloger",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.2.6",
        "status": "affected",
        "version": "1.2.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "brovy",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3",
        "status": "affected",
        "version": "1.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "construction-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.2.5",
        "status": "affected",
        "version": "1.2.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "doko",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.27",
        "status": "affected",
        "version": "1.0.27",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "edict-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.4",
        "status": "affected",
        "version": "1.1.4",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "enlighten",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.5",
        "status": "affected",
        "version": "1.3.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "fotography",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.4.0",
        "status": "affected",
        "version": "2.4.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "opstore",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.4.3",
        "status": "affected",
        "version": "1.4.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "parallaxsome",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.6",
        "status": "affected",
        "version": "1.3.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "punte",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.2",
        "status": "affected",
        "version": "1.1.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "revolve",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.1",
        "status": "affected",
        "version": "1.3.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ripple",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.2.0",
        "status": "affected",
        "version": "1.2.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "sakala",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.4",
        "status": "affected",
        "version": "1.0.4",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "scrollme",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.1.0",
        "status": "affected",
        "version": "2.1.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "storevilla",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.4.1",
        "status": "affected",
        "version": "1.4.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "swing-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.9",
        "status": "affected",
        "version": "1.1.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "swing-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.9",
        "status": "affected",
        "version": "1.1.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "the100",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.2",
        "status": "affected",
        "version": "1.1.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "the-launcher",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.2",
        "status": "affected",
        "version": "1.3.2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "the-monday",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.4.1",
        "status": "affected",
        "version": "1.4.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ultra-seven",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.2.8",
        "status": "affected",
        "version": "1.2.8",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "uncode-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.3",
        "status": "affected",
        "version": "1.3.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "vmag",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.2.7",
        "status": "affected",
        "version": "1.2.7",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "vmagazine-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.3.5",
        "status": "affected",
        "version": "1.3.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "vmagazine-news",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.5",
        "status": "affected",
        "version": "1.0.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "wpparallax",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.0.6",
        "status": "affected",
        "version": "2.0.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "wp-store",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.9",
        "status": "affected",
        "version": "1.1.9",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "zigcy-baby",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.6",
        "status": "affected",
        "version": "1.0.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "zigcy-cosmetics",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "1.0.5",
        "status": "affected",
        "version": "1.0.5",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "zigcy-lite",
    "vendor": "AccessPress Themes",
    "versions": [
      {
        "lessThanOrEqual": "2.0.9",
        "status": "affected",
        "version": "2.0.9",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php
patchstack	www.patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/
plugins	www.plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php
wordfence	www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285
file_location	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285
file	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285
host_type	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285
class_name	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285
slug	request body	wp-admin/admin-ajax.php	Unauthenticated or insufficiently authenticated arbitrary file upload via plugin_offline_installer AJAX action.	CWE-434, CWE-285

17 Jun 2026 04:03Current

8.5High risk

Vulners AI Score8.5

CVSS 26.5

CVSS 3.18.8

EPSS0.01652

SSVC