Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-24219— All Thrive Themes and Plugins - Unauthenticated Option Update

Quick assessment

Affected
Thrive Themes Thrive Optimize
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件是WordPress开源的一个应用插件。 多款Wordpress插件存在安全漏洞，该漏洞允许攻击者使用此端点将任意数据添加到wp_options表中的预定义选项。以下产品及版本受到影响：The Thrive Optimize WordPress plugin 1.4.13.3版本之前，Thrive Comments WordPress plugin 1.4.15.3版本之前，Thrive Headline Optimizer WordPress plugin 1.3.7.3版本之前

AI Predicted 6.5 Difficulty: Easy EPSS 2.06% · P81

Public Exploits 1

Nuclei · 1 CVE-2021-24219.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-24219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
All Thrive Themes and Plugins - Unauthenticated Option Update
Source: CVE Program / CVE List V5
Vulnerability Description
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Wordpress plugin Controlled Admin Access 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 多款Wordpress插件存在安全漏洞，该漏洞允许攻击者使用此端点将任意数据添加到wp_options表中的预定义选项。以下产品及版本受到影响：The Thrive Optimize WordPress plugin 1.4.13.3版本之前，Thrive Comments WordPress plugin 1.4.15.3版本之前，Thrive Headline Optimizer WordPress plugin 1.3.7.3版本之前
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Thrive Themes Thrive Optimize 1.4.13.3 ~ 1.4.13.3 -
Thrive Themes Thrive Comments 1.4.15.3 ~ 1.4.15.3 -
Thrive Themes Thrive Headline Optimizer 1.3.7.3 ~ 1.3.7.3 -
Thrive Themes Thrive Leads 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Ultimatum 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Quiz Builder 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Apprentice 2.3.9.4 ~ 2.3.9.4 -
Thrive Themes Thrive Visual Editor 2.6.7.4 ~ 2.6.7.4 -
Thrive Themes Thrive Dashboard 2.3.9.3 ~ 2.3.9.3 -
Thrive Themes Thrive Ovation 2.4.5 ~ 2.4.5 -
Thrive Themes Thrive Clever Widgets 1.57.1 ~ 1.57.1 -
Thrive Themes Rise by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Ignition by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Luxe by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes FocusBlog by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Minus by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Squared by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Voice 2.0.0 ~ 2.0.0 -
Thrive Themes Performag by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Pressive by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Storied by Thrive Themes 2.0.0 ~ 2.0.0 -
Thrive Themes Thrive Themes Builder 2.2.4 ~ 2.2.4 -

II. Public POCs for CVE-2021-24219

# POC Description Source Link Shenlong Link
1 The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24219.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-24219

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-24219 (2)

IV. Related Vulnerabilities

Same vendor: Thrive Themes
Same weakness: CWE-284

V. Comments for CVE-2021-24219

No comments yet

Leave a comment