CVE-2021-24867

CRITICAL

9.8

Descripcion

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado2/21/2022

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

accesspressthemes:accessbuddyaccesspressthemes:accesspress_anonymous_postaccesspressthemes:accesspress_basicaccesspressthemes:accesspress_custom_cssaccesspressthemes:accesspress_custom_post_typeaccesspressthemes:accesspress_ifeedsaccesspressthemes:accesspress_liteaccesspressthemes:accesspress_magaccesspressthemes:accesspress_parallaxaccesspressthemes:accesspress_rayaccesspressthemes:accesspress_rootaccesspressthemes:accesspress_social_counteraccesspressthemes:accesspress_social_iconsaccesspressthemes:accesspress_social_login_liteaccesspressthemes:accesspress_social_shareaccesspressthemes:accesspress_stapleaccesspressthemes:accesspress_storeaccesspressthemes:agency_liteaccesspressthemes:ap_companionaccesspressthemes:ap_contact_formaccesspressthemes:ap_custom_testimonialaccesspressthemes:ap_mega_menuaccesspressthemes:ap_pricing_tables_liteaccesspressthemes:apex_notification_bar_liteaccesspressthemes:apliteaccesspressthemes:badge_designer_lite_for_woocommerceaccesspressthemes:bingleaccesspressthemes:blogeraccesspressthemes:comments_disable_-_accesspressaccesspressthemes:construction_liteaccesspressthemes:dokoaccesspressthemes:easy_side_tabaccesspressthemes:enlightenaccesspressthemes:everest_admin_theme_liteaccesspressthemes:everest_coming_soon_liteaccesspressthemes:everest_comment_rating_liteaccesspressthemes:everest_counter_liteaccesspressthemes:everest_faq_manager_liteaccesspressthemes:everest_gallery_liteaccesspressthemes:everest_gplaces_business_reviewsaccesspressthemes:everest_review_liteaccesspressthemes:everest_tab_liteaccesspressthemes:everest_timeline_liteaccesspressthemes:fashstoreaccesspressthemes:form_store_to_dbaccesspressthemes:fotographyaccesspressthemes:gaga_corpaccesspressthemes:gaga_liteaccesspressthemes:inline_call_to_action_builder_liteaccesspressthemes:mcontact_buttonaccesspressthemes:one-pazeaccesspressthemes:parallax_blogaccesspressthemes:parallaxsomeaccesspressthemes:pi_buttonaccesspressthemes:product_slider_for_woocommerce_liteaccesspressthemes:punteaccesspressthemes:revolveaccesspressthemes:rippleaccesspressthemes:scrollmeaccesspressthemes:smart_logo_showcase_liteaccesspressthemes:smart_scroll_postsaccesspressthemes:smart_scroll_to_top_liteaccesspressthemes:social_auto_posteraccesspressthemes:social_reviewaccesspressthemes:sportsmagaccesspressthemes:storevillaaccesspressthemes:swing_liteaccesspressthemes:tauto_posteraccesspressthemes:the_launcheraccesspressthemes:the_mondayaccesspressthemes:total_gdpr_compliance_liteaccesspressthemes:total_team_liteaccesspressthemes:ultimate-form-builder-liteaccesspressthemes:ultimate_author_box_liteaccesspressthemes:uncode_liteaccesspressthemes:unicon_liteaccesspressthemes:vmagaccesspressthemes:vmagazine_liteaccesspressthemes:vmagazine_newsaccesspressthemes:wp_1_slideraccesspressthemes:wp_blog_manager_liteaccesspressthemes:wp_comment_designer_liteaccesspressthemes:wp_cookie_user_infoaccesspressthemes:wp_floating_menuaccesspressthemes:wp_media_manager_liteaccesspressthemes:wp_menu_icons_liteaccesspressthemes:wp_popup_bannersaccesspressthemes:wp_popup_liteaccesspressthemes:wp_product_gallery_liteaccesspressthemes:wp_tfeedaccesspressthemes:zigcy_babyaccesspressthemes:zigcy_cosmeticsaccesspressthemes:zigcy_lite

Debilidades (CWE)

CWE-912

Referencias

https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/(contact@wpscan.com)

https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff(contact@wpscan.com)

https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.