CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23976 – WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)
https://notcve.org/view.php?id=CVE-2022-23976
24 Jan 2022 — Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en Access Demo Importer versiones anteriores a 1.0.7 incluyéndola en WordPress, permite a un atacante restablecer todos los datos (posts / páginas / medios) The Access Demo Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.7 due to missing nonce v... • https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability-leading-to-data-reset-posts-pages-media • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23975 – WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation
https://notcve.org/view.php?id=CVE-2022-23975
11 Jan 2022 — Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en Access Demo Importer versiones anteriores a 1.0.7 incluyéndola en WordPress, permite a un atacante activar cualquier plugin instalado A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to unauthorized plugin deactivation and activation via the plugin_activation_callback ... • https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability-leading-to-arbitrary-plugin-activation • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 43EXPL: 1CVE-2021-39317 – AccessPress Themes - Authenticated Malicious File Upload
https://notcve.org/view.php?id=CVE-2021-39317
06 Oct 2021 — A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress... • https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes • CWE-285: Improper Authorization CWE-434: Unrestricted Upload of File with Dangerous Type •