Log in Start free

Vulnerability · Published Feb 21, 2022 · Assigned by WPScan

CVE-2021-24867Backdoored Plugins & Themes from AccessPress Themes

Critical 9.8

In plain English

A critical-severity security flaw in accessbuddy from AccessPress Themes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.0% (higher than 97% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)18.0%top 2.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Affected products (as reported)

VendorProductVersions
AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post 2.8.0 – before 2.8.0*2.8.1 – before 2.8.1
AccessPress Themes AccessPress Custom CSS 2.0.1 – before 2.0.1*2.0.2 – before 2.0.2
AccessPress Themes AccessPress Custom Post Type 1.0.8 – before 1.0.8*1.0.9 – before 1.0.9
AccessPress Themes Social Auto Poster 2.1.3 – before 2.1.3*2.1.4 – before 2.1.4
AccessPress Themes AccessPress iFeeds 4.0.3 – before 4.0.3*4.0.4 – before 4.0.4
AccessPress Themes PI Button 3.3.3 – before 3.3.3*3.3.4 – before 3.3.4
AccessPress Themes AccessPress Social Counter 1.9.1 – before 1.9.1*1.9.2 – before 1.9.2
AccessPress Themes AccessPress Social Icons 1.8.2 – before 1.8.2*1.8.3 – before 1.8.3
AccessPress Themes AccessPress Social Login Lite – Social Login WordPress Plugin 3.4.7 – before 3.4.7*3.4.8 – before 3.4.8
AccessPress Themes AccessPress Social Share 4.5.5 – before 4.5.5*4.5.6 – before 4.5.6
AccessPress Themes TAuto Poster 1.4.5 – before 1.4.5*1.4.6 – before 1.4.6
AccessPress Themes WP TFeed 1.6.7 – before 1.6.7*1.6.8 – before 1.6.8
AccessPress Themes Effectively Add & Customize Free Icons For WordPress Menus – WP Menu Icons Lite 1.0.9 – before 1.0.9
AccessPress Themes AP Companion 1.0.7 – before 1.0.7
AccessPress Themes Easiest Contact Form for WordPress – AP Contact Form 1.0.6 – before 1.0.6*1.0.7 – before 1.0.7
AccessPress Themes Testimonial WordPress Plugin – AP Custom Testimonial 1.4.6 – before 1.4.6*1.4.7 – before 1.4.7
AccessPress Themes Mega Menu Plugin for WordPress – AP Mega Menu 3.0.5 – before 3.0.5*3.0.6 – before 3.0.6
AccessPress Themes Pricing Table Builder – AP Pricing Tables Lite 1.1.3 – before 1.1.3*
AccessPress Themes Responsive Notification Bar Plugin for WordPress – Apex Notification Bar Lite 2.0.4 – before 2.0.4*2.0.5 – before 2.0.5
AccessPress Themes Form Store to DB 1.0.9 – before 1.0.9*1.1.0 – before 1.1.0
AccessPress Themes Comments Disable – AccessPress 1.0.7 – before 1.0.7*1.0.8 – before 1.0.8
AccessPress Themes CTA plugin for WordPress – Easy Side Tab 1.0.7 – before 1.0.7*1.0.8 – before 1.0.8
AccessPress Themes WordPress Backend Customizer – Everest Admin Theme Lite 1.0.7 – before 1.0.7*1.0.8 – before 1.0.8
AccessPress Themes Ultimate Coming Soon, Maintenance Mode Plugin for WordPress – Everest Coming Soon Lite 1.1.0 – before 1.1.0*1.1.1 – before 1.1.1
AccessPress Themes Free WordPress Plugin To Display Like/Dislike Comment Rating – Everest Comment Rating Lite 2.0.4 – before 2.0.4*2.0.5 – before 2.0.5
AccessPress Themes Beautiful Stat Counter Plugin for WordPress – Everest Counter Lite 2.0.7 – before 2.0.7*2.0.8 – before 2.0.8
AccessPress Themes Beautiful FAQ Plugin for WordPress – Everest FAQ Manager Lite 1.0.8 – before 1.0.8*1.0.9 – before 1.0.9
AccessPress Themes Responsive Media Gallery Plugin for WordPress – Everest Gallery Lite 1.0.8 – before 1.0.8*1.0.9 – before 1.0.9
AccessPress Themes Everest GPlaces Business Reviews 1.0.9 – before 1.0.9*2.0.0 – before 2.0.0
AccessPress Themes Everest Review Lite – User/Admin review plugin for WordPress 1.0.7

Weakness: CWE-912

References