CVE-2021-39317

CVE-2021-39317 describes a critical vulnerability in the AccessPress Demo Importer WordPress plugin (<=1.0.6) and numerous AccessPress Themes, allowing unauthenticated attackers to upload malicious files. This flaw stems from a missing capability check in the plugin_offline_installer AJAX action within the /demo-functions.php or /welcome.php files. Rated with a CVSS score of 8.8 (High), the vulnerability has a network attack vector and low attack complexity, enabling unauthorized users to achieve high confidentiality, integrity, and availability impacts. The EPSS score of 0.014 indicates a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.