ParallaxSome <= 1.3.6 is vulnerable to Arbitrary File Upload vulnerability

Subscriber

Published
2021-11-27

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products.

CVE

https://www.cve.org/CVERecord?id=CVE-2021-39317

CVSS

Score:8.8

Severity:High

Version: 1.3.6

There is a patch available in v1.3.7 and we strongly recommend you update to this version as soon as possible.