CVE-2021-24220

published 2021-04-12

CVE-2021-24220: Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme…

Priority P1 80 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C N I H A H

ITW EXPLOIT VulnCheck KEV

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
thrive_themes	focusblog_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	ignition_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	luxe_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	minus_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	performag_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	pressive_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	rise_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	squared_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	storied_by_thrive_themes	>= 2.0.0 < 2.0.0	2.0.0
thrive_themes	voice	>= 2.0.0 < 2.0.0	2.0.0
thrivethemes	focusblog	< 2.0.0	2.0.0
thrivethemes	ignition	< 2.0.0	2.0.0
thrivethemes	luxe	< 2.0.0	2.0.0
thrivethemes	minus	< 2.0.0	2.0.0
thrivethemes	performag	< 2.0.0	2.0.0
thrivethemes	pressive	< 2.0.0	2.0.0
thrivethemes	rise	< 2.0.0	2.0.0
thrivethemes	squared	< 2.0.0	2.0.0
thrivethemes	storied	< 2.0.0	2.0.0
thrivethemes	voice	< 2.0.0	2.0.0

Detection & IOCs extracted from sources · hover to see the quote

url /wp-content/themes/rise/style.css↗

path /wp-content/themes/rise/style.css↗

path /wp-content/themes/luxe/style.css↗

yara↗

Version: ([0-9.]+)

• → Probe each vulnerable Thrive theme's style.css via GET request; a 200 response containing 'Theme Name' and a version string less than 2.0.0 confirms a vulnerable installation. ↗
• → Match response body for theme name keywords (case-insensitive) to confirm which specific Thrive theme is installed: rise, luxe, minus, ignition, focusblog, squared, voice, performag, pressive, storied. ↗
• → The vulnerability abuses a REST API endpoint registered by the theme for Kraken image compression; monitor for crafted REST API requests combined with option update activity that reference remote URLs for file retrieval. ↗
• → Alert on creation or modification of executable PHP files in the WordPress theme directories, as the exploit can write or overwrite PHP files containing malicious code. ↗
• → CVE-2021-24220 was actively exploited in the wild; prioritize detection on internet-facing WordPress sites running any of the ten affected Thrive Legacy themes below version 2.0.0. ↗

• · Detection via style.css probing is passive/fingerprinting only; the actual exploit targets the Kraken REST API endpoint and requires chaining with the Option Update vulnerability (separate CVE). Ensure both attack vectors are monitored. ↗
• · The Nuclei template uses a 'batteringram' attack mode iterating over ten theme slugs; detection rules should cover all ten theme paths, not just focusblog (the CPE reference theme). ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:P

vulncheck 9.1 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434