CVE-2021-24220 : What You Need to Know

Thrive Themes Legacy Themes before version 2.0.0 are affected by an Unauthenticated Arbitrary File Upload and Option Deletion vulnerability.

Understanding CVE-2021-24220

This CVE highlights a critical security issue present in multiple Thrive Themes WordPress themes.

What is CVE-2021-24220?

The vulnerability allows unauthenticated attackers to upload files and delete options due to insecure handling of image compression.

The Impact of CVE-2021-24220

An attacker could exploit this vulnerability to upload malicious files to the site, potentially leading to remote code execution.

Technical Details of CVE-2021-24220

The vulnerability arises from allowing the registration of a REST API endpoint for image compression, which can be manipulated by attackers.

Vulnerability Description

By sending a crafted request and leveraging the Option Update flaw, attackers could retrieve and overwrite files with malicious content.

Affected Systems and Versions

Thrive Themes Legacy Themes including Rise, Luxe, Minus, Ignition, FocusBlog, Squared, Voice, Performag, Pressive, and Storied before version 2.0.0 are impacted.

Exploitation Mechanism

Attackers could misuse the image compression endpoint to fetch and replace existing files with malicious payloads.

Mitigation and Prevention

It is crucial to take immediate steps to secure affected systems and implement long-term security practices.

Immediate Steps to Take

Update the affected themes to version 2.0.0 or above and consider security plugins to enhance protection.

Long-Term Security Practices

Regularly update themes, plugins, and WordPress core, conduct security audits, and monitor for unauthorized modifications.

Patching and Updates

Stay informed about security patches from Thrive Themes and apply them promptly to mitigate the risk of exploitation.