Security readout for executives and security teams
Plain-English summary
An authenticated WordPress user could abuse affected AccessPress plugin or theme code to upload a malicious file. If a site has public registration or a compromised low-privilege account, this could become a full site compromise affecting data, content, and availability.
Executive priority
Treat this as high priority for any WordPress estate using AccessPress products. It is not cited as actively exploited here, but the business impact can be severe because a basic account could lead to site takeover.
Technical view
CVE-2021-39317 is a missing capability check and unrestricted upload issue in the plugin_offline_installer AJAX action. The vulnerable callback appears in demo-functions.php or welcome.php across AccessPress Demo Importer and many AccessPress themes. CVSS is 8.8 with low privileges required and high confidentiality, integrity, and availability impact.
Likely exposure
WordPress sites running AccessPress Demo Importer <=1.0.6 or the listed AccessPress themes at or below affected versions are exposed. Risk is higher where subscriber accounts, customer accounts, public registration, or compromised WordPress credentials exist.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is still serious because low-privilege authenticated access is enough, no user interaction is required, and successful abuse may enable malicious file placement.
Researcher notes
Evidence supports CWE-285 and CWE-434: missing authorization around an upload-related AJAX function. The bundle names many affected theme versions, but patch status appears clearer for AccessPress Demo Importer than for themes. Avoid assuming every theme has a fixed release without vendor confirmation.
Mitigation direction
- Upgrade AccessPress Demo Importer beyond the affected release where a vendor patch is available.
- Remove or replace affected AccessPress themes if no patched release is available.
- Delete inactive vulnerable themes and plugins from WordPress, not just deactivate them.
- Review vendor, Wordfence, and Patchstack guidance for product-specific remediation status.
- Restrict account creation and audit low-privilege users until remediation is complete.
- Inspect site files and uploads for unexpected executable or archive artifacts.
Validation and detection
- Inventory installed AccessPress plugins and themes and compare versions with the affected list.
- Confirm the plugin_offline_installer handler is absent, patched, or protected by capability checks.
- Check whether public registration or low-privilege account access is enabled.
- Review web server and WordPress logs for unusual authenticated AJAX upload activity.
- Verify removed vulnerable themes are no longer present on disk.
- Run focused regression tests for WordPress admin, theme, and import workflows after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-39317 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/CVE reference · x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.phpCVE reference · x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.phpCVE reference · x_refsource_MISC
- https://patchstack.com/articles/authenticated-vulnerability-in-unpatched-wordpress-themes/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.