8.8

CVE-2021-39317

Exploit

AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
Mögliche Gegenmaßnahme
Access Demo Importer: Update to version 1.0.7, or a newer patched version
Accesspress Basic: Update to version 3.2.2, or a newer patched version
AccessPress Lite: Update to version 2.93, or a newer patched version
AccessPress Mag: Update to version 2.6.6, or a newer patched version
AccessPress Parallax: Update to version 4.6, or a newer patched version
AccessPress Root: Update to version 2.6.0, or a newer patched version
AccessPress Staple: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
AccessPress Store: Update to version 2.5.0, or a newer patched version
Arrival: Update to version 1.4.3, or a newer patched version
Bingle: Update to version 1.0.5, or a newer patched version
Bloger: Update to version 1.2.7, or a newer patched version
Brovy: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Construction Lite: Update to version 1.2.6, or a newer patched version
Digital Agency Lite: Update to version 1.1.7, or a newer patched version
Doko: Update to version 1.1.0, or a newer patched version
Edict Lite: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Eight Sec: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
EightLaw Lite: Update to version 2.1.6, or a newer patched version
Eightmedi Lite: Update to version 2.1.9, or a newer patched version
EightStore Lite: Update to version 1.2.6, or a newer patched version
Enlighten: Update to version 1.3.6, or a newer patched version
FotoGraphy: Update to version 2.4.1, or a newer patched version
Opstore: Update to version 1.4.4, or a newer patched version
ParallaxSome: Update to version 1.3.7, or a newer patched version
Punte: Update to version 1.1.3, or a newer patched version
Revolve: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Ripple: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Sakala: Update to version 1.0.5, or a newer patched version
ScrollMe: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
StoreVilla: Update to version 1.4.2, or a newer patched version
Swing Lite: Update to version 1.2.0, or a newer patched version
The Launcher: Update to version 1.3.3, or a newer patched version
The Monday: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
The100: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Ultra Seven: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Uncode Lite: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
VMag: Update to version 1.2.8, or a newer patched version
VMagazine Lite: Update to version 1.3.6, or a newer patched version
Vmagazine News: Update to version 1.0.6, or a newer patched version
WP Store: Update to version 1.2.0, or a newer patched version
WPparallax: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Zigcy Baby: Update to version 1.0.7, or a newer patched version
Zigcy Cosmetics: Update to version 1.0.6, or a newer patched version
Zigcy Lite: Update to version 2.1.0, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Access Demo Importer
Version * - 1.0.6
SystemWordPress Theme
≫
Produkt Accesspress Basic
Version * - 3.2.1
SystemWordPress Theme
≫
Produkt AccessPress Lite
Version * - 2.92
SystemWordPress Theme
≫
Produkt AccessPress Mag
Version * - 2.6.5
SystemWordPress Theme
≫
Produkt AccessPress Parallax
Version * - 4.5
SystemWordPress Theme
≫
Produkt AccessPress Root
Version * - 2.5
SystemWordPress Theme
≫
Produkt AccessPress Staple
Version * - 1.9.1
SystemWordPress Theme
≫
Produkt AccessPress Store
Version * - 2.4.9
SystemWordPress Theme
≫
Produkt Arrival
Version * - 1.4.2
SystemWordPress Theme
≫
Produkt Bingle
Version * - 1.0.4
SystemWordPress Theme
≫
Produkt Bloger
Version * - 1.2.6
SystemWordPress Theme
≫
Produkt Brovy
Version * - 1.3
SystemWordPress Theme
≫
Produkt Construction Lite
Version * - 1.2.5
SystemWordPress Theme
≫
Produkt Digital Agency Lite
Version * - 1.1.6
SystemWordPress Theme
≫
Produkt Doko
Version * - 1.0.27
SystemWordPress Theme
≫
Produkt Edict Lite
Version * - 1.1.4
SystemWordPress Theme
≫
Produkt Eight Sec
Version * - 1.1.4
SystemWordPress Theme
≫
Produkt EightLaw Lite
Version * - 2.1.5
SystemWordPress Theme
≫
Produkt Eightmedi Lite
Version * - 2.1.8
SystemWordPress Theme
≫
Produkt EightStore Lite
Version * - 1.2.5
SystemWordPress Theme
≫
Produkt Enlighten
Version * - 1.3.5
SystemWordPress Theme
≫
Produkt FotoGraphy
Version * - 2.4.0
SystemWordPress Theme
≫
Produkt Opstore
Version * - 1.4.3
SystemWordPress Theme
≫
Produkt ParallaxSome
Version * - 1.3.6
SystemWordPress Theme
≫
Produkt Punte
Version * - 1.1.2
SystemWordPress Theme
≫
Produkt Revolve
Version * - 1.3.1
SystemWordPress Theme
≫
Produkt Ripple
Version * - 1.2.1
SystemWordPress Theme
≫
Produkt Sakala
Version * - 1.0.4
SystemWordPress Theme
≫
Produkt ScrollMe
Version * - 2.1.0
SystemWordPress Theme
≫
Produkt StoreVilla
Version * - 1.4.1
SystemWordPress Theme
≫
Produkt Swing Lite
Version * - 1.1.9
SystemWordPress Theme
≫
Produkt The Launcher
Version * - 1.3.2
SystemWordPress Theme
≫
Produkt The Monday
Version * - 1.4.1
SystemWordPress Theme
≫
Produkt The100
Version * - 1.1.2
SystemWordPress Theme
≫
Produkt Ultra Seven
Version * - 1.2.8
SystemWordPress Theme
≫
Produkt Uncode Lite
Version * - 1.3.3
SystemWordPress Theme
≫
Produkt VMag
Version * - 1.2.7
SystemWordPress Theme
≫
Produkt VMagazine Lite
Version * - 1.3.5
SystemWordPress Theme
≫
Produkt Vmagazine News
Version * - 1.0.5
SystemWordPress Theme
≫
Produkt WP Store
Version * - 1.1.9
SystemWordPress Theme
≫
Produkt WPparallax
Version * - 2.0.6
SystemWordPress Theme
≫
Produkt Zigcy Baby
Version * - 1.0.6
SystemWordPress Theme
≫
Produkt Zigcy Cosmetics
Version * - 1.0.5
SystemWordPress Theme
≫
Produkt Zigcy Lite
Version * - 2.0.9
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Accesspressthemes ≫ Access Demo Importer SwPlatformwordpress Version < 1.0.7
Accesspressthemes ≫ Accesspress-lite SwPlatformwordpress Version <= 2.92
Accesspressthemes ≫ Accesspress-mag SwPlatformwordpress Version <= 2.6.5
Accesspressthemes ≫ Accesspress-parallax SwPlatformwordpress Version <= 4.5
Accesspressthemes ≫ Accesspress-root SwPlatformwordpress Version <= 2.5
Accesspressthemes ≫ Accesspress-store SwPlatformwordpress Version <= 2.4.9
Accesspressthemes ≫ Accesspress Basic SwPlatformwordpress Version <= 3.2.1
Accesspressthemes ≫ Agency-lite SwPlatformwordpress Version <= 1.1.6
Accesspressthemes ≫ Arrival SwPlatformwordpress Version <= 1.4.2
Accesspressthemes ≫ Bingle SwPlatformwordpress Version <= 1.0.4
Accesspressthemes ≫ Bloger SwPlatformwordpress Version <= 1.2.6
Accesspressthemes ≫ Brovy SwPlatformwordpress Version <= 1.3
Accesspressthemes ≫ Construction-lite SwPlatformwordpress Version <= 1.2.5
Accesspressthemes ≫ Doko SwPlatformwordpress Version <= 1.0.27
Accesspressthemes ≫ Edict-lite SwPlatformwordpress Version <= 1.1.4
Accesspressthemes ≫ Eight-sec SwPlatformwordpress Version <= 1.1.4
Accesspressthemes ≫ Eightlaw-lite SwPlatformwordpress Version <= 2.1.5
Accesspressthemes ≫ Eightmedi-lite SwPlatformwordpress Version <= 2.1.8
Accesspressthemes ≫ Eightstore-lite SwPlatformwordpress Version <= 1.2.5
Accesspressthemes ≫ Enlighten SwPlatformwordpress Version <= 1.3.5
Accesspressthemes ≫ Fotography SwPlatformwordpress Version <= 2.4.0
Accesspressthemes ≫ Opstore SwPlatformwordpress Version <= 1.4.3
Accesspressthemes ≫ Parallaxsome SwPlatformwordpress Version <= 1.3.6
Accesspressthemes ≫ Punte SwPlatformwordpress Version <= 1.1.2
Accesspressthemes ≫ Revolve SwPlatformwordpress Version <= 1.3.1
Accesspressthemes ≫ Ripple SwPlatformwordpress Version <= 1.2.0
Accesspressthemes ≫ Sakala SwPlatformwordpress Version <= 1.0.4
Accesspressthemes ≫ Scrollme SwPlatformwordpress Version <= 2.1.0
Accesspressthemes ≫ Storevilla SwPlatformwordpress Version <= 1.4.1
Accesspressthemes ≫ Swing-lite SwPlatformwordpress Version <= 1.1.9
Accesspressthemes ≫ The-launcher SwPlatformwordpress Version <= 1.3.2
Accesspressthemes ≫ The-monday SwPlatformwordpress Version <= 1.4.1
Accesspressthemes ≫ The100 SwPlatformwordpress Version <= 1.1.2
Accesspressthemes ≫ Ultra-seven SwPlatformwordpress Version <= 1.2.8
Accesspressthemes ≫ Uncode-lite SwPlatformwordpress Version <= 1.3.3
Accesspressthemes ≫ Vmag SwPlatformwordpress Version <= 1.2.7
Accesspressthemes ≫ Vmagazine-lite SwPlatformwordpress Version <= 1.3.5
Accesspressthemes ≫ Vmagazine-news SwPlatformwordpress Version <= 1.0.5
Accesspressthemes ≫ Wp-store SwPlatformwordpress Version <= 1.1.9
Accesspressthemes ≫ Wpparallax SwPlatformwordpress Version <= 2.0.6
Accesspressthemes ≫ Zigcy-baby SwPlatformwordpress Version <= 1.0.6
Accesspressthemes ≫ Zigcy-cosmetics SwPlatformwordpress Version <= 1.0.5
Accesspressthemes ≫ Zigcy-lite SwPlatformwordpress Version <= 2.0.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.9% 0.75
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
security@wordfence.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.