peter bassill · operator
$ cve CVE-2021-24220 JSON

CVE-2021-24220

9.1
CRITICAL · CVSS 3.1 · EPSS 3.9% (pctl 90)

In your normal cycle

Critical by CVSS (9.1), but no sign of active exploitation.

Description

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.

Scoring

CVSS9.1 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS3.95% — more likely to be exploited than 90% of all CVEs
WeaknessCWE-434
On CISA KEVno
Public exploitnone known
Published2021-04-12
Last modified2026-06-17

Affected (10)

VendorProduct
thrivethemesfocusblog
thrivethemesignition
thrivethemesluxe
thrivethemesminus
thrivethemesperformag
thrivethemespressive
thrivethemesrise
thrivethemessquared
thrivethemesstoried
thrivethemesvoice

References

→ the Explorer  ·  watch your stack  ·  NVD