All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion
Priority MEDIUM 46CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
Why it matters now
EPSS 0.03946 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Rise by Thrive Themes (Thrive Themes): 2.0.0Luxe by Thrive Themes (Thrive Themes): 2.0.0+8 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Thrive Themes | Rise by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Luxe by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Minus by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Ignition by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | FocusBlog by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Squared by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Voice | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Performag by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Pressive by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
| Thrive Themes | Storied by Thrive Themes | 2.0.0 to before 2.0.0 | 2.0.0 | Patch available | CNA |
- Rise by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Luxe by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Minus by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Ignition by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- FocusBlog by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Squared by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Voice VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Performag by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Pressive by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
- Storied by Thrive Themes VendorThrive Themes Affected 2.0.0 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
| cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:* | before 2.0.0 | Vulnerable | Thrive Themes |
- cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:ignition:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:luxe:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:minus:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:performag:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:pressive:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:rise:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:squared:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:storied:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
- cpe:2.3:a:thrivethemes:voice:*:*:*:*:*:wordpress:*:* Versions before 2.0.0 Vulnerable ·Thrive Themes
Remediation
- Fix · CNA Rise by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Luxe by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Minus by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Ignition by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA FocusBlog by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Squared by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Voice (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Performag by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Pressive by Thrive Themes (Thrive Themes) Fixed in 2.0.0
- Fix · CNA Storied by Thrive Themes (Thrive Themes) Fixed in 2.0.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Thrive Themes FocusBlog by Thrive Themes, Ignition by Thrive Themes and 8 more products 2.0.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-06511 All Thrive Themes and Plugins - Unauthenticated Option UpdatePriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24220
- 2026-10-03 Alias added: GHSA-pf3q-84pr-fv6p
References
More Thrive Themes Focusblog vulnerabilities
- TI-2021-06511 All Thrive Themes and Plugins - Unauthenticated Option Update CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-24220 · CVE Program
- CVE-2021-24220 · NVD
- FIRST EPSS
- GHSA-pf3q-84pr-fv6p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences