CVE-2021-24220

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.

• CWE-434

• https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cacExploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wildThird Party Advisory
• https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cacExploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wildThird Party Advisory

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24215An Improper Access Control vulnerability was discovered in t…9.8
• CVE-2021-24216The All-in-One WP Migration WordPress plugin before 7.41 doe…7.2
• CVE-2021-24217The run_action function of the Facebook for WordPress plugin…8.1
• CVE-2021-24218The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_setting…8.8
• CVE-2021-24219The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive…5.3
• CVE-2021-2422Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-24221The Quiz And Survey Master – Best Quiz, Exam and Survey Plug…8.8
• CVE-2021-24222The WP-Curriculo Vitae Free WordPress plugin through 6.3 suf…9.8
• CVE-2021-24223The N5 Upload Form WordPress plugin through 1.0 suffers from…9.8
• CVE-2021-24224The EFBP_verify_upload_file AJAX action of the Easy Form Bui…8.8
• CVE-2021-24225The Advanced Booking Calendar WordPress plugin before 1.6.7 …5.4
• CVE-2021-24226In the AccessAlly WordPress plugin before 3.5.7, the file "r…7.5