AccessPress Themes - Authenticated Malicious File Upload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- AccessPress Themes Access Demo Importer
From 1.0.6 · through 1.0.6
- AccessPress Themes accesspress-basic
From 3.2.1 · through 3.2.1
- AccessPress Themes accesspress-lite
From 2.9.2 · through 2.9.2
- AccessPress Themes accesspress-mag
From 2.6.5 · through 2.6.5
- AccessPress Themes accesspress-parallax
From 4.5 · through 4.5
- AccessPress Themes accesspress-root
From 2.5 · through 2.5
- AccessPress Themes accesspress-store
From 2.4.9 · through 2.4.9
- AccessPress Themes agency-lite
From 1.1.6 · through 1.1.6
- AccessPress Themes arrival
From 1.4.2 · through 1.4.2
- AccessPress Themes bingle
From 1.0.4 · through 1.0.4
- AccessPress Themes bloger
From 1.2.6 · through 1.2.6
- AccessPress Themes brovy
From 1.3 · through 1.3
- AccessPress Themes construction-lite
From 1.2.5 · through 1.2.5
- AccessPress Themes doko
From 1.0.27 · through 1.0.27
- AccessPress Themes edict-lite
From 1.1.4 · through 1.1.4
- AccessPress Themes enlighten
From 1.3.5 · through 1.3.5
- AccessPress Themes fotography
From 2.4.0 · through 2.4.0
- AccessPress Themes opstore
From 1.4.3 · through 1.4.3
- AccessPress Themes parallaxsome
From 1.3.6 · through 1.3.6
- AccessPress Themes punte
From 1.1.2 · through 1.1.2
- AccessPress Themes revolve
From 1.3.1 · through 1.3.1
- AccessPress Themes ripple
From 1.2.0 · through 1.2.0
- AccessPress Themes sakala
From 1.0.4 · through 1.0.4
- AccessPress Themes scrollme
From 2.1.0 · through 2.1.0
- AccessPress Themes storevilla
From 1.4.1 · through 1.4.1
- AccessPress Themes swing-lite
From 1.1.9 · through 1.1.9
- AccessPress Themes swing-lite
From 1.1.9 · through 1.1.9
- AccessPress Themes the100
From 1.1.2 · through 1.1.2
- AccessPress Themes the-launcher
From 1.3.2 · through 1.3.2
- AccessPress Themes the-monday
From 1.4.1 · through 1.4.1
- AccessPress Themes ultra-seven
From 1.2.8 · through 1.2.8
- AccessPress Themes uncode-lite
From 1.3.3 · through 1.3.3
- AccessPress Themes vmag
From 1.2.7 · through 1.2.7
- AccessPress Themes vmagazine-lite
From 1.3.5 · through 1.3.5
- AccessPress Themes vmagazine-news
From 1.0.5 · through 1.0.5
- AccessPress Themes wpparallax
From 2.0.6 · through 2.0.6
- AccessPress Themes wp-store
From 1.1.9 · through 1.1.9
- AccessPress Themes zigcy-baby
From 1.0.6 · through 1.0.6
- AccessPress Themes zigcy-cosmetics
From 1.0.5 · through 1.0.5
- AccessPress Themes zigcy-lite
From 2.0.9 · through 2.0.9