Lucene search

WordfenceCVE-2021-39333

HistoryNov 01, 2021 - 9:15 p.m.

CVE-2021-39333

2021-11-0121:15:07

CWE-284

Wordfence

web.nvd.nist.gov

cve-2021-39333

hashthemes

demo importer plugin

wordpress

ajax

nonce

database security

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

29.0%

JSON

The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.

Affected configurations

Nvd

Vulners

Node

hashthemeshashthemes_demo_importerRange≤1.1.1wordpress

VendorProductVersionCPE
hashthemeshashthemes_demo_importer*cpe:2.3:a:hashthemes:hashthemes_demo_importer:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
hashthemes	hashthemes_demo_importer	*	cpe:2.3:a:hashthemes:hashthemes_demo_importer::::::wordpress::*

CNA Affected

[
  {
    "platforms": [
      "WordPress"
    ],
    "product": "Hashthemes Demo Importer",
    "vendor": "Hashthemes",
    "versions": [
      {
        "lessThanOrEqual": "1.1.1",
        "status": "affected",
        "version": "1.1.1",
        "versionType": "custom"
      }
    ]
  }
]

References

www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/

Social References

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.001

Percentile

29.0%

JSON

Related for CVE-2021-39333