CVE-2021-24867: Accesspressthemes Accessbuddy

Critical severity, CVSS 9.8. EPSS: 18% chance of exploitation in the next 30 days.

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

Affected products

• Accesspressthemes Accessbuddy: version 1.0.0 only
• Accesspressthemes Accesspress Anonymous Post: version 2.8.0 only
• Accesspressthemes Accesspress Basic: version 3.2.1 only
• Accesspressthemes Accesspress Custom Css: version 2.0.1 only
• Accesspressthemes Accesspress Custom Post Type: version 1.0.8 only
• Accesspressthemes Accesspress Ifeeds: version 4.0.3 only
• Accesspressthemes Accesspress Lite: version 2.92 only
• Accesspressthemes Accesspress Mag: version 2.6.5 only
• Accesspressthemes Accesspress Parallax: version 4.5 only
• Accesspressthemes Accesspress Ray: version 1.19.5 only
• Accesspressthemes Accesspress Root: version 2.5 only
• Accesspressthemes Accesspress Social Counter: version 1.9.1 only
• Accesspressthemes Accesspress Social Icons: version 1.8.2 only
• Accesspressthemes Accesspress Social Login Lite: version 3.4.7 only
• Accesspressthemes Accesspress Social Share: version 4.5.5 only
• Accesspressthemes Accesspress Staple: version 1.9.1 only
• Accesspressthemes Accesspress Store: version 2.4.9 only
• Accesspressthemes Agency Lite: version 1.1.6 only
• Accesspressthemes Ap Companion: before 1.0.7 (fixed in 1.0.7)
• Accesspressthemes Ap Contact Form: version 1.0.6 only
• Accesspressthemes Ap Custom Testimonial: version 1.4.6 only
• Accesspressthemes Ap Mega Menu: version 3.0.5 only
• Accesspressthemes Ap Pricing Tables Lite: version 1.1.2 only
• Accesspressthemes Apex Notification Bar Lite: version 2.0.4 only
• Accesspressthemes Aplite: version 1.0.6 only
• and 68 more

Published 2022-02-21. Last modified 2026-06-17.