Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Focusblog Theme | — | Update focusblog theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Ignition Theme | — | Update ignition theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Luxe Theme | — | Update luxe theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Minus Theme | — | Update minus theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Performag Theme | — | Update performag theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Pressive Theme | — | Update pressive theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Rise Theme | — | Update rise theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Squared Theme | — | Update squared theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Storied Theme | — | Update storied theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
| Voice Theme | — | Update voice theme to version 2.0.0, or a newer patched version | Dec 8, 2025 | Mar 24, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub