CVEvulnerability
CVE-2021-24867
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-02-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-912
Description
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
Affected configurations
• accesspressthemes accessbuddy 1.0.0
• accesspressthemes accesspress anonymous post 2.8.0
• accesspressthemes accesspress basic 3.2.1
• accesspressthemes accesspress custom css 2.0.1
• accesspressthemes accesspress custom post type 1.0.8
• accesspressthemes accesspress ifeeds 4.0.3
• accesspressthemes accesspress lite 2.92
• accesspressthemes accesspress mag 2.6.5
• accesspressthemes accesspress parallax 4.5
• accesspressthemes accesspress ray 1.19.5
• accesspressthemes accesspress root 2.5
• accesspressthemes accesspress social counter 1.9.1
• accesspressthemes accesspress social icons 1.8.2
• accesspressthemes accesspress social login lite 3.4.7
• accesspressthemes accesspress social share 4.5.5
• accesspressthemes accesspress staple 1.9.1
• accesspressthemes accesspress store 2.4.9
• accesspressthemes agency lite 1.1.6
• accesspressthemes ap companion (< 1.0.7)
• accesspressthemes ap contact form 1.0.6
• accesspressthemes ap custom testimonial 1.4.6
• accesspressthemes ap mega menu 3.0.5
• accesspressthemes ap pricing tables lite 1.1.2
• accesspressthemes apex notification bar lite 2.0.4
• accesspressthemes aplite 1.0.6
• accesspressthemes badge designer lite for woocommerce 1.1.0
• accesspressthemes bingle 1.0.4
• accesspressthemes bloger 1.2.6
• accesspressthemes comments disable - accesspress 1.0.7
• accesspressthemes construction lite 1.2.5
• accesspressthemes doko 1.0.27
• accesspressthemes easy side tab 1.0.7
• accesspressthemes enlighten 1.3.5
• accesspressthemes everest admin theme lite 1.0.7
• accesspressthemes everest coming soon lite 1.1.0
• accesspressthemes everest comment rating lite 2.0.4
• accesspressthemes everest counter lite 2.0.7
• accesspressthemes everest faq manager lite 1.0.8
• accesspressthemes everest gallery lite 1.0.8
• accesspressthemes everest gplaces business reviews 1.0.9
• accesspressthemes everest review lite 1.0.7
• accesspressthemes everest tab lite 2.0.3
• accesspressthemes everest timeline lite 1.1.1
• accesspressthemes fashstore 1.2.1
• accesspressthemes form store to db 1.0.9
• accesspressthemes fotography 2.4.0
• accesspressthemes gaga corp 1.0.8
• accesspressthemes gaga lite 1.4.2
• accesspressthemes inline call to action builder lite 1.1.0
• accesspressthemes mcontact button (< 2.0.7)
• accesspressthemes one-paze 2.2.8
• accesspressthemes parallax blog 3.1.1574941215
• accesspressthemes parallaxsome 1.3.6
• accesspressthemes pi button 3.3.3
• accesspressthemes product slider for woocommerce lite 1.1.5
• accesspressthemes punte 1.1.2
• accesspressthemes revolve 1.3.1
• accesspressthemes ripple 1.2.0
• accesspressthemes scrollme 2.1.0
• accesspressthemes smart logo showcase lite 1.1.7
… and 33 more
Related
Weakness · CWE (1)
- CWE-912 Hidden Functionality weakness
References
- https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff Exploit, Third Party Advisory
- https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff Exploit, Third Party Advisory