CVE & CISA-KEV Catalog

CVE-2021-24220

CRITICALEPSS 89th pctl
9.1
CVSS v3
NVD

Description

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.

CWE-434Unrestricted File Upload

How to fix

Remediation Available
focusblogNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
ignitionNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
luxeNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
minusNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
performagNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
pressiveNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
riseNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
squaredNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
storiedNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD
voiceNVD
Affected:< 2.0.0Fixed in:2.0.0CVE-2021-24220derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploit Intelligence

3.95%probability of exploitation in 30 days
89thpercentile

Elevated risk: more likely to be exploited than 89% of all known CVEs.

References

Exploit1
Third-Party Advisory1

Related Vulnerabilities

Other CWE-434 (Unrestricted File Upload) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2017-12617High8.1100%KEVFix
CVE-2018-15961Critical9.8100%KEV-
CVE-2021-31207Medium6.6100%KEV + RansomFix
CVE-2017-12615High8.1100%KEV + Ransom-
CVE-2025-31324Critical10.099%KEV + Ransom-
CVE-2024-50623Critical9.899%KEV + RansomFix
Embed a live status badge for CVE-2021-24220
CVE-2021-24220 severity badge

Markdown

[![CVE-2021-24220](https://tridentstack.com/cve/badge/CVE-2021-24220.svg)](https://tridentstack.com/cve/CVE-2021-24220)

HTML

<a href="https://tridentstack.com/cve/CVE-2021-24220"><img src="https://tridentstack.com/cve/badge/CVE-2021-24220.svg" alt="CVE-2021-24220"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.