CVE-2021-24867Not scoredCWE-912

CVE-2021-24867: Backdoored Plugins & Themes from AccessPress Themes

AccessPress Themes · Frontend Post WordPress Plugin – AccessPress Anonymous Post

Vendor fix available · Affected: AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post · Exploitation: likely to be exploited (10% or more)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

18.0%probability of exploitation in the next 30 days

97th percentile

050100

Higher than 97% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

AccessPress Themes · Frontend Post WordPress Plugin – AccessPress Anonymous Postfrom 2.8.0 before 2.8.0*; from 2.8.1 before 2.8.1
AccessPress Themes · AccessPress Custom CSSfrom 2.0.1 before 2.0.1*; from 2.0.2 before 2.0.2
AccessPress Themes · AccessPress Custom Post Typefrom 1.0.8 before 1.0.8*; from 1.0.9 before 1.0.9
AccessPress Themes · Social Auto Posterfrom 2.1.3 before 2.1.3*; from 2.1.4 before 2.1.4
AccessPress Themes · AccessPress iFeedsfrom 4.0.3 before 4.0.3*; from 4.0.4 before 4.0.4
AccessPress Themes · PI Buttonfrom 3.3.3 before 3.3.3*; from 3.3.4 before 3.3.4
AccessPress Themes · AccessPress Social Counterfrom 1.9.1 before 1.9.1*; from 1.9.2 before 1.9.2
AccessPress Themes · AccessPress Social Iconsfrom 1.8.2 before 1.8.2*; from 1.8.3 before 1.8.3
AccessPress Themes · AccessPress Social Login Lite – Social Login WordPress Pluginfrom 3.4.7 before 3.4.7*; from 3.4.8 before 3.4.8
AccessPress Themes · AccessPress Social Sharefrom 4.5.5 before 4.5.5*; from 4.5.6 before 4.5.6
AccessPress Themes · TAuto Posterfrom 1.4.5 before 1.4.5*; from 1.4.6 before 1.4.6
AccessPress Themes · WP TFeedfrom 1.6.7 before 1.6.7*; from 1.6.8 before 1.6.8
AccessPress Themes · Effectively Add & Customize Free Icons For WordPress Menus – WP Menu Icons Litefrom 1.0.9 before 1.0.9
AccessPress Themes · AP Companionfrom 1.0.7 before 1.0.7
AccessPress Themes · Easiest Contact Form for WordPress – AP Contact Formfrom 1.0.6 before 1.0.6*; from 1.0.7 before 1.0.7
AccessPress Themes · Testimonial WordPress Plugin – AP Custom Testimonialfrom 1.4.6 before 1.4.6*; from 1.4.7 before 1.4.7
AccessPress Themes · Mega Menu Plugin for WordPress – AP Mega Menufrom 3.0.5 before 3.0.5*; from 3.0.6 before 3.0.6
AccessPress Themes · Pricing Table Builder – AP Pricing Tables Litefrom 1.1.3 before 1.1.3*
AccessPress Themes · Responsive Notification Bar Plugin for WordPress – Apex Notification Bar Litefrom 2.0.4 before 2.0.4*; from 2.0.5 before 2.0.5
AccessPress Themes · Form Store to DBfrom 1.0.9 before 1.0.9*; from 1.1.0 before 1.1.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Likely to be exploited (10% or more). EPSS gives it a 10% or higher chance of exploitation in the next 30 days.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Hidden Functionality · Supply Chain and Malicious Code
Vendor: AccessPress Themes
Published: February 2022
Band: Likely to be exploited (10% or more), February 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2021-24867 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.