phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

CVE-2021-39317: A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

high Affects access-demo-importer (WordPress plugin), accesspress-basic (WordPress plugin), accesspress-lite (WordPress plugin), accesspress-mag (WordPress plugin), accesspress-parallax (WordPress plugin), accesspress-root (WordPress plugin) and 37 more. Feed 2026.10.29.1, updated 2026-10-28; published ; advisory modified .

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
access-demo-importer (WordPress plugin) WordPress
Affected versions
<1.0.7
Fixed in
1.0.7
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-basic (WordPress plugin) WordPress
Affected versions
<=3.2.1
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-lite (WordPress plugin) WordPress
Affected versions
<=2.92
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-mag (WordPress plugin) WordPress
Affected versions
<=2.6.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-parallax (WordPress plugin) WordPress
Affected versions
<=4.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-root (WordPress plugin) WordPress
Affected versions
<=2.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
accesspress-store (WordPress plugin) WordPress
Affected versions
<=2.4.9
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
agency-lite (WordPress plugin) WordPress
Affected versions
<=1.1.6
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
arrival (WordPress plugin) WordPress
Affected versions
<=1.4.2
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
bingle (WordPress plugin) WordPress
Affected versions
<=1.0.4
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
bloger (WordPress plugin) WordPress
Affected versions
<=1.2.6
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
brovy (WordPress plugin) WordPress
Affected versions
<=1.3
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
construction-lite (WordPress plugin) WordPress
Affected versions
<=1.2.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
doko (WordPress plugin) WordPress
Affected versions
<=1.0.27
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
edict-lite (WordPress plugin) WordPress
Affected versions
<=1.1.4
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
eight-sec (WordPress plugin) WordPress
Affected versions
<=1.1.4
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
eightlaw-lite (WordPress plugin) WordPress
Affected versions
<=2.1.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
eightmedi-lite (WordPress plugin) WordPress
Affected versions
<=2.1.8
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
eightstore-lite (WordPress plugin) WordPress
Affected versions
<=1.2.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
enlighten (WordPress plugin) WordPress
Affected versions
<=1.3.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
fotography (WordPress plugin) WordPress
Affected versions
<=2.4.0
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
opstore (WordPress plugin) WordPress
Affected versions
<=1.4.3
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
parallaxsome (WordPress plugin) WordPress
Affected versions
<=1.3.6
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
punte (WordPress plugin) WordPress
Affected versions
<=1.1.2
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
revolve (WordPress plugin) WordPress
Affected versions
<=1.3.1
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
ripple (WordPress plugin) WordPress
Affected versions
<=1.2.0
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
sakala (WordPress plugin) WordPress
Affected versions
<=1.0.4
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
scrollme (WordPress plugin) WordPress
Affected versions
<=2.1.0
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
storevilla (WordPress plugin) WordPress
Affected versions
<=1.4.1
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
swing-lite (WordPress plugin) WordPress
Affected versions
<=1.1.9
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
the-launcher (WordPress plugin) WordPress
Affected versions
<=1.3.2
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
the-monday (WordPress plugin) WordPress
Affected versions
<=1.4.1
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
the100 (WordPress plugin) WordPress
Affected versions
<=1.1.2
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
ultra-seven (WordPress plugin) WordPress
Affected versions
<=1.2.8
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
uncode-lite (WordPress plugin) WordPress
Affected versions
<=1.3.3
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
vmag (WordPress plugin) WordPress
Affected versions
<=1.2.7
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
vmagazine-lite (WordPress plugin) WordPress
Affected versions
<=1.3.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
vmagazine-news (WordPress plugin) WordPress
Affected versions
<=1.0.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
wp-store (WordPress plugin) WordPress
Affected versions
<=1.1.9
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
wpparallax (WordPress plugin) WordPress
Affected versions
<=2.0.6
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
zigcy-baby (WordPress plugin) WordPress
Affected versions
<=1.0.6
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
zigcy-cosmetics (WordPress plugin) WordPress
Affected versions
<=1.0.5
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check

Package
zigcy-lite (WordPress plugin) WordPress
Affected versions
<=2.0.9
Fixed in
no fix recorded
Severity
high  CVSS 8.8
Exploitation
not on CISA KEV · EPSS 2% (77.2th percentile)
Published
2021-10-11
Source
nvd

References

CWE-285CWE-434
NVD recordaccess-demo-importer (WordPress plugin) advisoriesaccesspress-basic (WordPress plugin) advisoriesaccesspress-lite (WordPress plugin) advisoriesaccesspress-mag (WordPress plugin) advisoriesaccesspress-parallax (WordPress plugin) advisoriesaccesspress-root (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked

Related advisories