Read the docs
TI-2021-06511 Aliases CVE-2021-24219GHSA-w835-mmvc-qqfv

All Thrive Themes and Plugins - Unauthenticated Option Update

Priority LOW 29CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.

Why it matters now

EPSS 0.02467 84th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Thrive Optimize (Thrive Themes): 1.4.13.3Thrive Comments (Thrive Themes): 1.4.15.3+20 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Thrive ThemesThrive Optimize1.4.13.3 to before 1.4.13.31.4.13.3Patch availableCNA
Thrive ThemesThrive Comments1.4.15.3 to before 1.4.15.31.4.15.3Patch availableCNA
Thrive ThemesThrive Headline Optimizer1.3.7.3 to before 1.3.7.31.3.7.3Patch availableCNA
Thrive ThemesThrive Leads2.3.9.4 to before 2.3.9.42.3.9.4Patch availableCNA
Thrive ThemesThrive Ultimatum2.3.9.4 to before 2.3.9.42.3.9.4Patch availableCNA
Thrive ThemesThrive Quiz Builder2.3.9.4 to before 2.3.9.42.3.9.4Patch availableCNA
Thrive ThemesThrive Apprentice2.3.9.4 to before 2.3.9.42.3.9.4Patch availableCNA
Thrive ThemesThrive Visual Editor2.6.7.4 to before 2.6.7.42.6.7.4Patch availableCNA
Thrive ThemesThrive Dashboard2.3.9.3 to before 2.3.9.32.3.9.3Patch availableCNA
Thrive ThemesThrive Ovation2.4.5 to before 2.4.52.4.5Patch availableCNA
Thrive ThemesThrive Clever Widgets1.57.1 to before 1.57.11.57.1Patch availableCNA
Thrive ThemesRise by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesIgnition by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesLuxe by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesFocusBlog by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesMinus by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesSquared by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesVoice2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesPerformag by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesPressive by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesStoried by Thrive Themes2.0.0 to before 2.0.02.0.0Patch availableCNA
Thrive ThemesThrive Themes Builder2.2.4 to before 2.2.42.2.4Patch availableCNA
  • Thrive Optimize VendorThrive Themes Affected 1.4.13.3 to before 1.4.13.3 Fixed in 1.4.13.3 Patch available CNA
  • Thrive Comments VendorThrive Themes Affected 1.4.15.3 to before 1.4.15.3 Fixed in 1.4.15.3 Patch available CNA
  • Thrive Headline Optimizer VendorThrive Themes Affected 1.3.7.3 to before 1.3.7.3 Fixed in 1.3.7.3 Patch available CNA
  • Thrive Leads VendorThrive Themes Affected 2.3.9.4 to before 2.3.9.4 Fixed in 2.3.9.4 Patch available CNA
  • Thrive Ultimatum VendorThrive Themes Affected 2.3.9.4 to before 2.3.9.4 Fixed in 2.3.9.4 Patch available CNA
  • Thrive Quiz Builder VendorThrive Themes Affected 2.3.9.4 to before 2.3.9.4 Fixed in 2.3.9.4 Patch available CNA
  • Thrive Apprentice VendorThrive Themes Affected 2.3.9.4 to before 2.3.9.4 Fixed in 2.3.9.4 Patch available CNA
  • Thrive Visual Editor VendorThrive Themes Affected 2.6.7.4 to before 2.6.7.4 Fixed in 2.6.7.4 Patch available CNA
  • Thrive Dashboard VendorThrive Themes Affected 2.3.9.3 to before 2.3.9.3 Fixed in 2.3.9.3 Patch available CNA
  • Thrive Ovation VendorThrive Themes Affected 2.4.5 to before 2.4.5 Fixed in 2.4.5 Patch available CNA
  • Thrive Clever Widgets VendorThrive Themes Affected 1.57.1 to before 1.57.1 Fixed in 1.57.1 Patch available CNA
  • Rise by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Ignition by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Luxe by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • FocusBlog by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Minus by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Squared by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Voice VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Performag by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Pressive by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Storied by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • Thrive Themes Builder VendorThrive Themes Affected 2.2.4 to before 2.2.4 Fixed in 2.2.4 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_apprentice:*:*:*:*:*:wordpress:*:*before 2.3.9.4VulnerableThrive Themes
  • cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_apprentice:*:*:*:*:*:wordpress:*:* Versions before 2.3.9.4 Vulnerable ·Thrive Themes
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:thrivethemes:thrive_clever_widgets:*:*:*:*:*:wordpress:*:*before 1.57.1VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_comments:*:*:*:*:*:wordpress:*:*before 1.4.15.3VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_dashboard:*:*:*:*:*:wordpress:*:*before 2.3.9.3VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_headline_optimizer:*:*:*:*:*:wordpress:*:*before 1.3.7.3VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_optimize:*:*:*:*:*:wordpress:*:*before 1.4.13.3VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_ovation:*:*:*:*:*:wordpress:*:*before 2.4.5VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_quiz_builder:*:*:*:*:*:wordpress:*:*before 2.3.9.4VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_themes_builder:*:*:*:*:*:wordpress:*:*before 2.2.4VulnerableThrive Themes
cpe:2.3:a:thrivethemes:thrive_visual_editor:*:*:*:*:*:wordpress:*:*before 2.6.7.4VulnerableThrive Themes
cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:*before 2.0.0VulnerableThrive Themes
  • cpe:2.3:a:thrivethemes:thrive_clever_widgets:*:*:*:*:*:wordpress:*:* Versions before 1.57.1 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_comments:*:*:*:*:*:wordpress:*:* Versions before 1.4.15.3 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_dashboard:*:*:*:*:*:wordpress:*:* Versions before 2.3.9.3 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_headline_optimizer:*:*:*:*:*:wordpress:*:* Versions before 1.3.7.3 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_optimize:*:*:*:*:*:wordpress:*:* Versions before 1.4.13.3 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_ovation:*:*:*:*:*:wordpress:*:* Versions before 2.4.5 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_quiz_builder:*:*:*:*:*:wordpress:*:* Versions before 2.3.9.4 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_themes_builder:*:*:*:*:*:wordpress:*:* Versions before 2.2.4 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:thrive_visual_editor:*:*:*:*:*:wordpress:*:* Versions before 2.6.7.4 Vulnerable ·Thrive Themes
  • cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes

Remediation

  • Fix · CNA Thrive Optimize (Thrive Themes) Fixed in 1.4.13.3
  • Fix · CNA Thrive Comments (Thrive Themes) Fixed in 1.4.15.3
  • Fix · CNA Thrive Headline Optimizer (Thrive Themes) Fixed in 1.3.7.3
  • Fix · CNA Thrive Leads (Thrive Themes) Fixed in 2.3.9.4
  • Fix · CNA Thrive Ultimatum (Thrive Themes) Fixed in 2.3.9.4
  • Fix · CNA Thrive Quiz Builder (Thrive Themes) Fixed in 2.3.9.4
  • Fix · CNA Thrive Apprentice (Thrive Themes) Fixed in 2.3.9.4
  • Fix · CNA Thrive Visual Editor (Thrive Themes) Fixed in 2.6.7.4
  • Fix · CNA Thrive Dashboard (Thrive Themes) Fixed in 2.3.9.3
  • Fix · CNA Thrive Ovation (Thrive Themes) Fixed in 2.4.5
  • Fix · CNA Thrive Clever Widgets (Thrive Themes) Fixed in 1.57.1
  • Fix · CNA Rise by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Ignition by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Luxe by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA FocusBlog by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Minus by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Squared by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Voice (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Performag by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Pressive by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Storied by Thrive Themes (Thrive Themes) Fixed in 2.0.0
  • Fix · CNA Thrive Themes Builder (Thrive Themes) Fixed in 2.2.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Thrive Themes FocusBlog by Thrive Themes, Ignition by Thrive Themes and 8 more products 2.0.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06512 All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option DeletionPriority MEDIUM 46
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24219
  2. 2026-10-03 Alias added: GHSA-w835-mmvc-qqfv

References

Exploit 1

Advisory 1

  • TI-2021-06512 All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences