Cyber Resilience

CVE-2021-24867

CriticalPublic PoC

Published: 21 February 2022

Published
21 February 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0476 89.7th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-24867 is a critical-severity Hidden Functionality (CWE-912) vulnerability in Accesspressthemes Accessbuddy. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all…

more

of them were updated or removed to avoid any confusion

CWE(s)
CWE-912

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

accesspressthemes
accessbuddy
1.0.0
accesspressthemes
accesspress anonymous post
2.8.0
accesspressthemes
accesspress basic
3.2.1
accesspressthemes
accesspress custom css
2.0.1
accesspressthemes
accesspress custom post type
1.0.8
accesspressthemes
accesspress ifeeds
4.0.3
accesspressthemes
accesspress lite
2.92
accesspressthemes
accesspress mag
2.6.5
accesspressthemes
accesspress parallax
4.5
accesspressthemes
accesspress ray
1.19.5
+83 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CM-8 System Component Inventory
addresses: CWE-912

Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.

CP-10 System Recovery and Reconstitution
addresses: CWE-912

Recovery eliminates hidden functionality or backdoors introduced during compromise.

PM-30 Supply Chain Risk Management Strategy
addresses: CWE-912

Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.

PS-2 Position Risk Designation
addresses: CWE-912

Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.

RA-10 Threat Hunting
addresses: CWE-912

Hunting identifies hidden functionality used for persistence or evasion after initial compromise.

RA-6 Technical Surveillance Countermeasures Survey
addresses: CWE-912

TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.

SA-10 Developer Configuration Management
addresses: CWE-912

Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.

SA-12 Supply Chain Protection
addresses: CWE-912

Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.

References