Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2021-39333: The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to exe...
CVE-2021-39333 · published 5 years ago
Summary
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/upload...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hashthemes | hashthemes_demo_importer |
<= 1.1.1 cpe:2.3:a:hashthemes:hashthemes_demo_importer:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to exe...
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.
References
- https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes... Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published1 Nov 2021
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-39333 · NVD
Track software like this
Free during beta