NVD

CVE-2021-39317 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

CNA: Wordfence

Base Score: 8.8 HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 6.5 MEDIUM

Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/	CVE, Wordfence	Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php	CVE, Wordfence	Patch Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php	CVE, Wordfence	Patch Third Party Advisory
https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/	CVE, Wordfence	Exploit Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-434	Unrestricted Upload of File with Dangerous Type	NIST Wordfence
CWE-285	Improper Authorization	Wordfence

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

8 change records found show changes

CVE Modified by Wordfence 6/17/2026 12:03:32 AM

Action

Type

Old Value

New Value

Added

Affected

Record truncated, showing 2048 of 6293 characters.
View Entire Change Record

[{"vendor":"AccessPress Themes","product":"Access Demo Importer","versions":[{"version":"1.0.6","lessThanOrEqual":"1.0.6","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-basic","versions":[{"version":"3.2.1","lessThanOrEqual":"3.2.1","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-lite","versions":[{"version":"2.9.2","lessThanOrEqual":"2.9.2","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-mag","versions":[{"version":"2.6.5","lessThanOrEqual":"2.6.5","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-parallax","versions":[{"version":"4.5","lessThanOrEqual":"4.5","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-root","versions":[{"version":"2.5","lessThanOrEqual":"2.5","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"accesspress-store","versions":[{"version":"2.4.9","lessThanOrEqual":"2.4.9","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"agency-lite","versions":[{"version":"1.1.6","lessThanOrEqual":"1.1.6","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"arrival","versions":[{"version":"1.4.2","lessThanOrEqual":"1.4.2","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"bingle","versions":[{"version":"1.0.4","lessThanOrEqual":"1.0.4","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"bloger","versions":[{"version":"1.2.6","lessThanOrEqual":"1.2.6","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"brovy","versions":[{"version":"1.3","lessThanOrEqual":"1.3","versionType":"custom","status":"affected"}]},{"vendor":"AccessPress Themes","product":"construction-lite","versions":[{"version":"1.2.5","lessThanOrEqual":"1.2.5","versionType":"custom

CVE Modified by CVE 11/21/2024 1:19:13 AM

Action	Type	New Value
Added	Reference	https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/
Added	Reference	https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php
Added	Reference	https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php
Added	Reference	https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/

Reanalysis by NIST 12/09/2022 11:43:10 AM

Action

Type

Old Value

New Value

Changed

CPE Configuration

Record truncated, showing 2048 of 4415 characters.
View Entire Change Record

OR
     *cpe:2.3:a:accesspressthemes:access_demo_importer:*:*:*:*:*:wordpress:*:* versions up to (excluding) 1.0.7
     *cpe:2.3:a:accesspressthemes:accesspress-basic:*:*:*:*:*:wordpress:*:* versions up to (including) 3.2.1
     *cpe:2.3:a:accesspressthemes:accesspress-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.92
     *cpe:2.3:a:accesspressthemes:accesspress-mag:*:*:*:*:*:wordpress:*:* versions up to (including) 2.6.5
     *cpe:2.3:a:accesspressthemes:accesspress-parallax:*:*:*:*:*:wordpress:*:* versions up to (including) 4.5
     *cpe:2.3:a:accesspressthemes:accesspress-root:*:*:*:*:*:wordpress:*:* versions up to (including) 2.5
     *cpe:2.3:a:accesspressthemes:accesspress-store:*:*:*:*:*:wordpress:*:* versions up to (including) 2.4.9
     *cpe:2.3:a:accesspressthemes:agency-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.6
     *cpe:2.3:a:accesspressthemes:arrival:*:*:*:*:*:wordpress:*:* versions up to (including) 1.4.2
     *cpe:2.3:a:accesspressthemes:bingle:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.4
     *cpe:2.3:a:accesspressthemes:bloger:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.6
     *cpe:2.3:a:accesspressthemes:brovy:*:*:*:*:*:wordpress:*:* versions up to (including) 1.3
     *cpe:2.3:a:accesspressthemes:construction-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:doko:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.27
     *cpe:2.3:a:accesspressthemes:edict-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eight-sec:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eightlaw-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.5
     *cpe:2.3:a:accesspressthemes:eightmedi-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.8
     *cpe:2.3:a:accesspressthemes:eightstore-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:enlighten:*:*:*:*:*:wordpress:*

Record truncated, showing 2048 of 4415 characters.
View Entire Change Record

OR
     *cpe:2.3:a:accesspressthemes:access_demo_importer:*:*:*:*:*:wordpress:*:* versions up to (excluding) 1.0.7
     *cpe:2.3:a:accesspressthemes:accesspress-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.92
     *cpe:2.3:a:accesspressthemes:accesspress-mag:*:*:*:*:*:wordpress:*:* versions up to (including) 2.6.5
     *cpe:2.3:a:accesspressthemes:accesspress-parallax:*:*:*:*:*:wordpress:*:* versions up to (including) 4.5
     *cpe:2.3:a:accesspressthemes:accesspress-root:*:*:*:*:*:wordpress:*:* versions up to (including) 2.5
     *cpe:2.3:a:accesspressthemes:accesspress-store:*:*:*:*:*:wordpress:*:* versions up to (including) 2.4.9
     *cpe:2.3:a:accesspressthemes:accesspress_basic:*:*:*:*:*:wordpress:*:* versions up to (including) 3.2.1
     *cpe:2.3:a:accesspressthemes:agency-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.6
     *cpe:2.3:a:accesspressthemes:arrival:*:*:*:*:*:wordpress:*:* versions up to (including) 1.4.2
     *cpe:2.3:a:accesspressthemes:bingle:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.4
     *cpe:2.3:a:accesspressthemes:bloger:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.6
     *cpe:2.3:a:accesspressthemes:brovy:*:*:*:*:*:wordpress:*:* versions up to (including) 1.3
     *cpe:2.3:a:accesspressthemes:construction-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:doko:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.27
     *cpe:2.3:a:accesspressthemes:edict-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eight-sec:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eightlaw-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.5
     *cpe:2.3:a:accesspressthemes:eightmedi-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.8
     *cpe:2.3:a:accesspressthemes:eightstore-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:enlighten:*:*:*:*:*:wordpress:*

Modified Analysis by NIST 2/18/2022 11:43:40 PM

Action

Type

Old Value

New Value

Changed

CPE Configuration

OR
     *cpe:2.3:a:accesspressthemes:access_demo_importer:*:*:*:*:*:wordpress:*:* versions up to (excluding) 1.0.7

Record truncated, showing 2048 of 4415 characters.
View Entire Change Record

OR
     *cpe:2.3:a:accesspressthemes:access_demo_importer:*:*:*:*:*:wordpress:*:* versions up to (excluding) 1.0.7
     *cpe:2.3:a:accesspressthemes:accesspress-basic:*:*:*:*:*:wordpress:*:* versions up to (including) 3.2.1
     *cpe:2.3:a:accesspressthemes:accesspress-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.92
     *cpe:2.3:a:accesspressthemes:accesspress-mag:*:*:*:*:*:wordpress:*:* versions up to (including) 2.6.5
     *cpe:2.3:a:accesspressthemes:accesspress-parallax:*:*:*:*:*:wordpress:*:* versions up to (including) 4.5
     *cpe:2.3:a:accesspressthemes:accesspress-root:*:*:*:*:*:wordpress:*:* versions up to (including) 2.5
     *cpe:2.3:a:accesspressthemes:accesspress-store:*:*:*:*:*:wordpress:*:* versions up to (including) 2.4.9
     *cpe:2.3:a:accesspressthemes:agency-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.6
     *cpe:2.3:a:accesspressthemes:arrival:*:*:*:*:*:wordpress:*:* versions up to (including) 1.4.2
     *cpe:2.3:a:accesspressthemes:bingle:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.4
     *cpe:2.3:a:accesspressthemes:bloger:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.6
     *cpe:2.3:a:accesspressthemes:brovy:*:*:*:*:*:wordpress:*:* versions up to (including) 1.3
     *cpe:2.3:a:accesspressthemes:construction-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:doko:*:*:*:*:*:wordpress:*:* versions up to (including) 1.0.27
     *cpe:2.3:a:accesspressthemes:edict-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eight-sec:*:*:*:*:*:wordpress:*:* versions up to (including) 1.1.4
     *cpe:2.3:a:accesspressthemes:eightlaw-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.5
     *cpe:2.3:a:accesspressthemes:eightmedi-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 2.1.8
     *cpe:2.3:a:accesspressthemes:eightstore-lite:*:*:*:*:*:wordpress:*:* versions up to (including) 1.2.5
     *cpe:2.3:a:accesspressthemes:enlighten:*:*:*:*:*:wordpress:*

Changed

Reference Type

https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/ No Types Assigned

https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/ Third Party Advisory

CVE Modified by Wordfence 1/13/2022 4:15:07 PM

Action	Type	Old Value	New Value
Changed	Description	Versions up to, and including, 1.0.6, of the Access Demo Importer WordPress plugin are vulnerable to arbitrary file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the ~/inc/demo-functions.php.	A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.3.5 vmagazine-news <= 1.0.5 wpparallax <= 2.0.6 wp-store <= 1.1.9 zigcy-baby <= 1.0.6 zigcy-cosmetics <= 1.0.5 zigcy-lite <= 2.0.9
Added	CWE		Wordfence CWE-434
Added	Reference		https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/ [No Types Assigned]
Removed	CWE Reason	CWE-285 / More specific CWE option available

Initial Analysis by NIST 10/15/2021 9:02:43 PM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CVSS V2		NIST (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Added	CWE		NIST CWE-434
Added	CPE Configuration		OR cpe:2.3:a:accesspressthemes:access_demo_importer::::::wordpress:: versions up to (excluding) 1.0.7
Changed	Reference Type	https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php No Types Assigned	https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php Patch, Third Party Advisory
Changed	Reference Type	https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php No Types Assigned	https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php Patch, Third Party Advisory
Changed	Reference Type	https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/ No Types Assigned	https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/ Exploit, Third Party Advisory

Quick Info

CVE Dictionary Entry:
CVE-2021-39317
NVD Published Date:
10/11/2021
NVD Last Modified:
06/17/2026
Source:
Wordfence

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2021-39317 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by CISA-ADP 6/17/2026 12:03:32 AM

CVE Modified by Wordfence 6/17/2026 12:03:32 AM

CVE Modified by CVE 11/21/2024 1:19:13 AM

CVE Modified by Wordfence 5/14/2024 5:22:51 AM

Reanalysis by NIST 12/09/2022 11:43:10 AM

Modified Analysis by NIST 2/18/2022 11:43:40 PM

CVE Modified by Wordfence 1/13/2022 4:15:07 PM

Initial Analysis by NIST 10/15/2021 9:02:43 PM

Quick Info