CVE-2021-24219

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.

• CWE-284
• CWE-306

• https://wpscan.com/vulnerability/35acd2d8-85fc-4af5-8f6c-224fa7d92900Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wildThird Party Advisory
• https://wpscan.com/vulnerability/35acd2d8-85fc-4af5-8f6c-224fa7d92900Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wildThird Party Advisory

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24213The GiveWP – Donation Plugin and Fundraising Platform WordPr…6.1
• CVE-2021-24214The OpenID Connect Generic Client WordPress plugin 3.8.0 and…6.1
• CVE-2021-24215An Improper Access Control vulnerability was discovered in t…9.8
• CVE-2021-24216The All-in-One WP Migration WordPress plugin before 7.41 doe…7.2
• CVE-2021-24217The run_action function of the Facebook for WordPress plugin…8.1
• CVE-2021-24218The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_setting…8.8
• CVE-2021-2422Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-24220Thrive “Legacy” Rise by Thrive Themes WordPress theme before…9.1
• CVE-2021-24221The Quiz And Survey Master – Best Quiz, Exam and Survey Plug…8.8
• CVE-2021-24222The WP-Curriculo Vitae Free WordPress plugin through 6.3 suf…9.8
• CVE-2021-24223The N5 Upload Form WordPress plugin through 1.0 suffers from…9.8
• CVE-2021-24224The EFBP_verify_upload_file AJAX action of the Easy Form Bui…8.8