CVE-2021-24867 Backdoored Plugins & Themes from AccessPress Themes
Attackers can execute arbitrary code and access data via backdoored WordPress plugins and themes distributed from a compromised vendor website.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24867?
CVE-2021-24867 is a critical vulnerability in AccessPress Themes AP Companion, published on 21 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
Weakness: CWE-912
Which versions are affected by CVE-2021-24867?
It affects 93 products.
Products include Accesspressthemes Accessbuddy, Accesspressthemes Accesspress Anonymous Post, Accesspressthemes Accesspress Basic, Accesspressthemes Accesspress Custom Css, Accesspressthemes Accesspress Custom Post Type, Accesspressthemes Accesspress Ifeeds and 87 more.
How do I fix CVE-2021-24867?
No fix has been published for CVE-2021-24867 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24867 being exploited?
There is no known exploitation of CVE-2021-24867 in the wild and no public exploit code.
Sources
Also known as GHSA-8cff-vwcw-f7mc.