Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2021-24220: Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Theme...
CVE-2021-24220 · published 5 years ago
Summary
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thr...
What to do
- Update thrivethemes focusblog to version 2.0.0 or later.
- Update thrivethemes ignition to version 2.0.0 or later.
- Update thrivethemes luxe to version 2.0.0 or later.
- Update thrivethemes minus to version 2.0.0 or later.
- Update thrivethemes performag to version 2.0.0 or later.
- Update thrivethemes pressive to version 2.0.0 or later.
- Update thrivethemes rise to version 2.0.0 or later.
- Update thrivethemes squared to version 2.0.0 or later.
- Update thrivethemes storied to version 2.0.0 or later.
- Update thrivethemes voice to version 2.0.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| thrivethemes | focusblog |
< 2.0.0 cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:* |
| thrivethemes | ignition |
< 2.0.0 cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:* |
| thrivethemes | luxe |
< 2.0.0 cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:* |
| thrivethemes | minus |
< 2.0.0 cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:* |
| thrivethemes | performag |
< 2.0.0 cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:* |
| thrivethemes | pressive |
< 2.0.0 cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:* |
| thrivethemes | rise |
< 2.0.0 cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:* |
| thrivethemes | squared |
< 2.0.0 cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:* |
| thrivethemes | storied |
< 2.0.0 cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:* |
| thrivethemes | voice |
< 2.0.0 cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:* |
Original advisory text
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Theme...
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
References
- https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac Exploit Third Party Advisory
- https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-... Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-434Unrestricted File Upload
Timeline
Published12 Apr 2021
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-24220 · NVD
Track software like this
Free during beta