Paper/Archive/CVE-2021-24867

CVE-2021-24867

AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post — Backdoored Plugins & Themes from AccessPress Themes

EPSS 18%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 97.2.972 × 2019.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Affected

ProductAffectedFixed inSource

Frontend Post WordPress Plugin – AccessPress Anonymous Post2.8.0 – < 2.8.0*2.8.0*CNA

Frontend Post WordPress Plugin – AccessPress Anonymous Post2.8.1 – < 2.8.12.8.1CNA

AccessPress Custom CSS2.0.1 – < 2.0.1*2.0.1*CNA

AccessPress Custom CSS2.0.2 – < 2.0.22.0.2CNA

AccessPress Custom Post Type1.0.8 – < 1.0.8*1.0.8*CNA

AccessPress Custom Post Type1.0.9 – < 1.0.91.0.9CNA

Social Auto Poster2.1.3 – < 2.1.3*2.1.3*CNA

Social Auto Poster2.1.4 – < 2.1.42.1.4CNA

AccessPress iFeeds4.0.3 – < 4.0.3*4.0.3*CNA

AccessPress iFeeds4.0.4 – < 4.0.44.0.4CNA

PI Button3.3.3 – < 3.3.3*3.3.3*CNA

PI Button3.3.4 – < 3.3.43.3.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff refjetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes