Skip to content
Fencer Vulns
high 8.8

CVE-2021-39317 json

AccessPress Themes - Authenticated Malicious File Upload

published 2021-10-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-25678

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9

Patch / fix

  • accesspressthemes access_demo_importer 1.0.7

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

1.71% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • wordfence.com https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • AccessPress Themes Access Demo Importer
  • AccessPress Themes accesspress-basic
  • AccessPress Themes accesspress-lite
  • AccessPress Themes accesspress-mag
  • AccessPress Themes accesspress-parallax
  • AccessPress Themes accesspress-root
  • AccessPress Themes accesspress-store
  • AccessPress Themes agency-lite
  • AccessPress Themes arrival
  • AccessPress Themes bingle
  • AccessPress Themes bloger
  • AccessPress Themes brovy
  • AccessPress Themes construction-lite
  • AccessPress Themes doko
  • AccessPress Themes edict-lite
  • AccessPress Themes enlighten
  • AccessPress Themes fotography
  • AccessPress Themes opstore
  • AccessPress Themes parallaxsome
  • AccessPress Themes punte
  • AccessPress Themes revolve
  • AccessPress Themes ripple
  • AccessPress Themes sakala
  • AccessPress Themes scrollme
  • AccessPress Themes storevilla
  • AccessPress Themes swing-lite
  • AccessPress Themes the100
  • AccessPress Themes the-launcher
  • AccessPress Themes the-monday
  • AccessPress Themes ultra-seven
  • AccessPress Themes uncode-lite
  • AccessPress Themes vmag
  • AccessPress Themes vmagazine-lite
  • AccessPress Themes vmagazine-news
  • AccessPress Themes wpparallax
  • AccessPress Themes wp-store
  • AccessPress Themes zigcy-baby
  • AccessPress Themes zigcy-cosmetics
  • AccessPress Themes zigcy-lite

Classification

Weakness
  • CWE-285 Improper Authorization
  • CWE-434 Unrestricted Upload of File with Dangerous Type
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.