PT-2021-15764 · Thrive Themes · Ignition+8

Charles Sweethill + 2 · Published 2021-04-12 · Updated 2025-10-23 · CVE-2021-24220

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Thrive “Legacy” Rise by Thrive Themes WordPress theme versions prior to 2.0.0 Luxe by Thrive Themes WordPress theme versions prior to 2.0.0 Minus by Thrive Themes WordPress theme versions prior to 2.0.0 Ignition by Thrive Themes WordPress theme versions prior to 2.0.0 FocusBlog by Thrive Themes WordPress theme versions prior to 2.0.0 Squared by Thrive Themes WordPress theme versions prior to 2.0.0 Voice WordPress theme versions prior to 2.0.0 Performag by Thrive Themes WordPress theme versions prior to 2.0.0 Pressive by Thrive Themes WordPress theme versions prior to 2.0.0 Storied by Thrive Themes WordPress theme versions prior to 2.0.0

Description: The issue allows an attacker to supply a crafted request to a REST API endpoint, which is used to compress images using the Kraken image optimization engine. This can be combined with data inserted using the Option Update vulnerability to retrieve malicious code from a remote URL and overwrite an existing file on the site or create a new file, including executable PHP files containing malicious code.

Recommendations: For Thrive “Legacy” Rise by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Luxe by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Minus by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Ignition by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For FocusBlog by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Squared by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Voice WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Performag by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Pressive by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later. For Storied by Thrive Themes WordPress theme version prior to 2.0.0, update to version 2.0.0 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-24220

Affected Products

Focusblog

Ignition

Luxe

Minus

Performa

Pressive

Squared

Storied

Thrive "Legacy" Rise

References · 5

• 🔥 https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac · Exploit
• https://osv.dev/vulnerability/CVE-2021-24220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24220 · Security Note
• https://twitter.com/pdnuclei_bot/status/1981284495115637241 · Twitter Post
• https://wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild · Note