CVE-2021-24220
Description
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
How to fix
- thrivethemes focusblog2.0.0 or later
- thrivethemes ignition2.0.0 or later
- thrivethemes luxe2.0.0 or later
- thrivethemes minus2.0.0 or later
- thrivethemes performag2.0.0 or later
- thrivethemes pressive2.0.0 or later
- thrivethemes rise2.0.0 or later
- thrivethemes squared2.0.0 or later
- thrivethemes storied2.0.0 or later
- thrivethemes voice2.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thrivethemes focusblog | v < 2.0.0 | 2.0.0 |
| thrivethemes ignition | v < 2.0.0 | 2.0.0 |
| thrivethemes luxe | v < 2.0.0 | 2.0.0 |
| thrivethemes minus | v < 2.0.0 | 2.0.0 |
| thrivethemes performag | v < 2.0.0 | 2.0.0 |
| thrivethemes pressive | v < 2.0.0 | 2.0.0 |
| thrivethemes rise | v < 2.0.0 | 2.0.0 |
| thrivethemes squared | v < 2.0.0 | 2.0.0 |
| thrivethemes storied | v < 2.0.0 | 2.0.0 |
| thrivethemes voice | v < 2.0.0 | 2.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.