CVE-2021-39317 – AccessPress Themes - Authenticated Malicious File Upload

https://notcve.org/view.php?id=CVE-2021-39317

06 Oct 2021 — A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress... • https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes • CWE-285: Improper Authorization CWE-434: Unrestricted Upload of File with Dangerous Type •