CVE-2021-24867

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-248684.3The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscCVE-2021-248698.8The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL staCVE-2021-248706.1The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitiCVE-2021-248715.4The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could alloCVE-2021-248726.5The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata withouCVE-2021-248736.1The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student RegCVE-2021-248746.1The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid paraCVE-2021-248756.1The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting iCVE-2021-248766.1The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attrCVE-2021-248777.2The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leadiCVE-2021-248786.1The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpCVE-2021-248798.8The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escapin
CVE-2021-24867: Critical severity, CVSS 9.8 | Vulnix