What’s Vulnerable › Vulnerabilities

CVE-2021-24867: Backdoored Plugins & Themes from AccessPress Themes

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-21 · updated 2026-06-17
• Weakness: CWE-912

Description

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Affected products

• AccessPress Themes accessbuddy: 1.0.0
• Accesspressthemes Accesspress Anonymous Post: 2.8.0
• AccessPress Themes Accesspress Basic: 3.2.1
• AccessPress Themes AccessPress Custom CSS: 2.0.1
• AccessPress Themes AccessPress Custom Post Type: 1.0.8
• AccessPress Themes AccessPress iFeeds: 4.0.3
• AccessPress Themes Accesspress Lite: 2.92
• AccessPress Themes Accesspress Mag: 2.6.5
• AccessPress Themes AccessPress Parallax: 4.5
• Accesspressthemes Accesspress Ray: 1.19.5
• AccessPress Themes AccessPress Root: 2.5
• AccessPress Themes AccessPress Social Counter: 1.9.1
• AccessPress Themes AccessPress Social Icons: 1.8.2
• Accesspressthemes Accesspress Social Login Lite: 3.4.7
• AccessPress Themes AccessPress Social Share: 4.5.5
• AccessPress Themes AccessPress Staple: 1.9.1
• AccessPress Themes AccessPress Store: 2.4.9
• AccessPress Themes Agency Lite: 1.1.6
• AccessPress Themes AP Companion: before 1.0.7 — fixed in 1.0.7
• Accesspressthemes Ap Contact Form: 1.0.6
• Testimonial WordPress Plugin – AP Custom Testimonial: 1.4.6
• Mega Menu Plugin for WordPress – AP Mega Menu: 3.0.5
• Accesspressthemes Ap Pricing Tables Lite: 1.1.2
• Accesspressthemes Apex Notification Bar Lite: 2.0.4
• AccessPress Themes Aplite: 1.0.6
• AccessPress Themes Badge Designer Lite For WooCommerce: 1.1.0
• AccessPress Themes Bingle: 1.0.4
• AccessPress Themes Bloger: 1.2.6
• Accesspressthemes Comments Disable - Accesspress: 1.0.7
• AccessPress Themes Construction Lite: 1.2.5

How to fix

Upgrade to a fixed version: AccessPress Themes AP Companion 1.0.7; AccessPress Themes MContact Button 2.0.7. Check the vendor advisory for mitigations.

References

• https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
• https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff
• https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
• https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff

Get alerted when CVE-2021-24867 or the next vulnerability affects your stack