CVE-2021-39317
Description
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
How to fix
- accesspressthemes access_demo_importer1.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| accesspressthemes access_demo_importer | v < 1.0.7 | 1.0.7 |
| accesspressthemes accesspress-lite | v ≤ 2.92 | — |
| accesspressthemes accesspress-mag | v ≤ 2.6.5 | — |
| accesspressthemes accesspress-parallax | v ≤ 4.5 | — |
| accesspressthemes accesspress-root | v ≤ 2.5 | — |
| accesspressthemes accesspress-store | v ≤ 2.4.9 | — |
| accesspressthemes accesspress_basic | v ≤ 3.2.1 | — |
| accesspressthemes agency-lite | v ≤ 1.1.6 | — |
| accesspressthemes arrival | v ≤ 1.4.2 | — |
| accesspressthemes bingle | v ≤ 1.0.4 | — |
| accesspressthemes bloger | v ≤ 1.2.6 | — |
| accesspressthemes brovy | v ≤ 1.3 | — |
| accesspressthemes construction-lite | v ≤ 1.2.5 | — |
| accesspressthemes doko | v ≤ 1.0.27 | — |
| accesspressthemes edict-lite | v ≤ 1.1.4 | — |
| accesspressthemes eight-sec | v ≤ 1.1.4 | — |
| accesspressthemes eightlaw-lite | v ≤ 2.1.5 | — |
| accesspressthemes eightmedi-lite | v ≤ 2.1.8 | — |
| accesspressthemes eightstore-lite | v ≤ 1.2.5 | — |
| accesspressthemes enlighten | v ≤ 1.3.5 | — |
| accesspressthemes fotography | v ≤ 2.4.0 | — |
| accesspressthemes opstore | v ≤ 1.4.3 | — |
| accesspressthemes parallaxsome | v ≤ 1.3.6 | — |
| accesspressthemes punte | v ≤ 1.1.2 | — |
| accesspressthemes revolve | v ≤ 1.3.1 | — |
| accesspressthemes ripple | v ≤ 1.2.0 | — |
| accesspressthemes sakala | v ≤ 1.0.4 | — |
| accesspressthemes scrollme | v ≤ 2.1.0 | — |
| accesspressthemes storevilla | v ≤ 1.4.1 | — |
| accesspressthemes swing-lite | v ≤ 1.1.9 | — |
| accesspressthemes the-launcher | v ≤ 1.3.2 | — |
| accesspressthemes the-monday | v ≤ 1.4.1 | — |
| accesspressthemes the100 | v ≤ 1.1.2 | — |
| accesspressthemes ultra-seven | v ≤ 1.2.8 | — |
| accesspressthemes uncode-lite | v ≤ 1.3.3 | — |
| accesspressthemes vmag | v ≤ 1.2.7 | — |
| accesspressthemes vmagazine-lite | v ≤ 1.3.5 | — |
| accesspressthemes vmagazine-news | v ≤ 1.0.5 | — |
| accesspressthemes wp-store | v ≤ 1.1.9 | — |
| accesspressthemes wpparallax | v ≤ 2.0.6 | — |
| accesspressthemes zigcy-baby | v ≤ 1.0.6 | — |
| accesspressthemes zigcy-cosmetics | v ≤ 1.0.5 | — |
| accesspressthemes zigcy-lite | v ≤ 2.0.9 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.