{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hashthemes:hashthemes_demo_importer:*:*:*:*:*:wordpress:*:*",
                     matchCriteriaId: "C7597492-E643-48A8-9A49-96984B4E89E2",
                     versionEndIncluding: "1.1.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.",
      },
      {
         lang: "es",
         value: "El plugin Hashthemes Demo Importer para WordPress versiones anteriores a 1.1.1 incluyéndola, contenía varias funciones AJAX que dependían de un nonce que era visible para todos los usuarios conectados para el control de acceso, permitiéndoles ejecutar una función que truncaba casi todas las tablas de la base de datos y eliminaba el contenido de wp-content/uploads",
      },
   ],
   id: "CVE-2021-39333",
   lastModified: "2024-11-21T06:19:15.477",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 5.5,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.2,
            source: "security@wordfence.com",
            type: "Secondary",
         },
      ],
   },
   published: "2021-11-01T21:15:07.747",
   references: [
      {
         source: "security@wordfence.com",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
      },
   ],
   sourceIdentifier: "security@wordfence.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "security@wordfence.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T02:06:41.799Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2021-39333",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:46:20.405276Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:46:23.086Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               platforms: [
                  "WordPress",
               ],
               product: "Hashthemes Demo Importer",
               vendor: "Hashthemes",
               versions: [
                  {
                     lessThanOrEqual: "1.1.1",
                     status: "affected",
                     version: "1.1.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Ramuel Gall, Wordfence",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "CWE-284 Improper Access Control",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-11-01T21:01:12.000Z",
            orgId: "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
            shortName: "Wordfence",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         title: "Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@wordfence.com",
               ID: "CVE-2021-39333",
               STATE: "PUBLIC",
               TITLE: "Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content Deletion",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Hashthemes Demo Importer",
                                 version: {
                                    version_data: [
                                       {
                                          platform: "WordPress",
                                          version_affected: "<=",
                                          version_name: "1.1.1",
                                          version_value: "1.1.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Hashthemes",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "Ramuel Gall, Wordfence",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-284 Improper Access Control",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
                     refsource: "MISC",
                     url: "https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/",
                  },
               ],
            },
            source: {
               discovery: "INTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
      assignerShortName: "Wordfence",
      cveId: "CVE-2021-39333",
      datePublished: "2021-11-01T21:01:12.000Z",
      dateReserved: "2021-08-20T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:46:23.086Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}