High severity8.1NVD Advisory· Published Nov 1, 2021· Updated Jun 17, 2026
CVE-2021-39333
CVE-2021-39333
Description
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.
Affected products
2- Range: <=1.1.1
- Hashthemes/Hashthemes Demo Importerv5Range: 1.1.1
Patches
Vulnerability mechanics
References
1- www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.