VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Multiple Thrive Themes and Plugins (Various Versions) — Arbitrary Options Update

CVE-2021-24219Published · Updated

Action summary

Thrive Leads: Affected: <2.3.9.4Update to 2.3.9.4 or newer

Thrive Themes Builder: Affected: <2.2.4Update to 2.2.4 or newer

Thrive Visual Editor: Affected: <2.6.7.4Update to 2.6.7.4 or newer

Thrive Apprentice: Affected: <2.3.9.4Update to 2.3.9.4 or newer

Thrive Optimize: Affected: <1.4.13.3Update to 1.4.13.3 or newer

Thrive Dashboard: Affected: <2.3.9.3Update to 2.3.9.3 or newer

Thrive Clever Widgets: Affected: <1.57.1Update to 1.57.1 or newer

Thrive Ultimatum: Affected: <2.3.9.4Update to 2.3.9.4 or newer

Ignition: Affected: <2.0.0Update to 2.0.0 or newer

Storied: Affected: <2.0.0Update to 2.0.0 or newer

Luxe: Affected: <2.0.0Update to 2.0.0 or newer

Thrive Comments: Affected: <1.4.15.3Update to 1.4.15.3 or newer

Voice: Affected: <2.0.0Update to 2.0.0 or newer

Thrive Ovation: Affected: <2.4.5Update to 2.4.5 or newer

Squared: Affected: <2.0.0Update to 2.0.0 or newer

Performag: Affected: <2.0.0Update to 2.0.0 or newer

Minus: Affected: <2.0.0Update to 2.0.0 or newer

Thrive Quiz Builder: Affected: <2.3.9.4Update to 2.3.9.4 or newer

Pressive: Affected: <2.0.0Update to 2.0.0 or newer

Rise: Affected: <2.0.0Update to 2.0.0 or newer

FocusBlog: Affected: <2.0.0Update to 2.0.0 or newer

Thrive Headline Optimizer: Affected: <1.3.7.3Update to 1.3.7.3 or newer

All remediation steps
Watch plugin
Severity
Medium5.3
CVSS
5.3
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:N User interaction
None
S:U Scope
Unchanged
C:N Confidentiality
None
I:L Integrity
Low
A:N Availability
None
Weakness
CWE-284 Improper Access Control
Required access
No account needed
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page8

Am I affected?

Thrive Leads thrive-leads

  1. Affected< 2.3.9.4
  2. Patched in2.3.9.4

Update to 2.3.9.4 or newer.

You are affected if you run < 2.3.9.4. Version 2.3.9.4 and later are not affected by this issue.

Thrive Themes Builder thrive-theme

  1. Affected< 2.2.4
  2. Patched in2.2.4

Update to 2.2.4 or newer.

You are affected if you run < 2.2.4. Version 2.2.4 and later are not affected by this issue.

Thrive Visual Editor thrive-visual-editor

  1. Affected< 2.6.7.4
  2. Patched in2.6.7.4

Update to 2.6.7.4 or newer.

You are affected if you run < 2.6.7.4. Version 2.6.7.4 and later are not affected by this issue.

Thrive Apprentice thrive-apprentice

  1. Affected< 2.3.9.4
  2. Patched in2.3.9.4

Update to 2.3.9.4 or newer.

You are affected if you run < 2.3.9.4. Version 2.3.9.4 and later are not affected by this issue.

Thrive Optimize thrive-ab-page-testing

  1. Affected< 1.4.13.3
  2. Patched in1.4.13.3

Update to 1.4.13.3 or newer.

You are affected if you run < 1.4.13.3. Version 1.4.13.3 and later are not affected by this issue.

Thrive Dashboard thrive-dashboard

  1. Affected< 2.3.9.3
  2. Patched in2.3.9.3

Update to 2.3.9.3 or newer.

You are affected if you run < 2.3.9.3. Version 2.3.9.3 and later are not affected by this issue.

Thrive Clever Widgets thrive-clever-widgets

  1. Affected< 1.57.1
  2. Patched in1.57.1

Update to 1.57.1 or newer.

You are affected if you run < 1.57.1. Version 1.57.1 and later are not affected by this issue.

Thrive Ultimatum thrive-ultimatum

  1. Affected< 2.3.9.4
  2. Patched in2.3.9.4

Update to 2.3.9.4 or newer.

You are affected if you run < 2.3.9.4. Version 2.3.9.4 and later are not affected by this issue.

Ignition ignition

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Storied storied

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Luxe luxe

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Thrive Comments thrive-comments

  1. Affected< 1.4.15.3
  2. Patched in1.4.15.3

Update to 1.4.15.3 or newer.

You are affected if you run < 1.4.15.3. Version 1.4.15.3 and later are not affected by this issue.

Voice voice

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Thrive Ovation thrive-ovation

  1. Affected< 2.4.5
  2. Patched in2.4.5

Update to 2.4.5 or newer.

You are affected if you run < 2.4.5. Version 2.4.5 and later are not affected by this issue.

Squared squared

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Performag performag

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Minus minus

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Thrive Quiz Builder thrive-quiz-builder

  1. Affected< 2.3.9.4
  2. Patched in2.3.9.4

Update to 2.3.9.4 or newer.

You are affected if you run < 2.3.9.4. Version 2.3.9.4 and later are not affected by this issue.

Pressive pressive

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Rise rise

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

FocusBlog focusblog

  1. Affected< 2.0.0
  2. Patched in2.0.0

Update to 2.0.0 or newer.

You are affected if you run < 2.0.0. Version 2.0.0 and later are not affected by this issue.

Thrive Headline Optimizer thrive-headline-optimizer

  1. Affected< 1.3.7.3
  2. Patched in1.3.7.3

Update to 1.3.7.3 or newer.

You are affected if you run < 1.3.7.3. Version 1.3.7.3 and later are not affected by this issue.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Thrive Leads.
  • No admin access? Run a passive check of your site. It reads public files only.
  • No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

  1. Update to version 2.3.9.4, or a newer patched version
  2. Update to version 2.2.4, or a newer patched version
  3. Update to version 2.6.7.4, or a newer patched version
  4. Update to version 2.3.9.4, or a newer patched version
  5. Update to version 1.4.13.3, or a newer patched version
  6. Update to version 2.3.9.3, or a newer patched version
  7. Update to version 1.57.1, or a newer patched version
  8. Update to version 2.3.9.4, or a newer patched version
  9. Update to version 2.0.0, or a newer patched version
  10. Update to version 2.0.0, or a newer patched version
  11. Update to version 2.0.0, or a newer patched version
  12. Update to version 1.4.15.3, or a newer patched version
  13. Update to version 2.0.0, or a newer patched version
  14. Update to version 2.4.5, or a newer patched version
  15. Update to version 2.0.0, or a newer patched version
  16. Update to version 2.0.0, or a newer patched version
  17. Update to version 2.0.0, or a newer patched version
  18. Update to version 2.3.9.4, or a newer patched version
  19. Update to version 2.0.0, or a newer patched version
  20. Update to version 2.0.0, or a newer patched version
  21. Update to version 2.0.0, or a newer patched version
  22. Update to version 1.3.7.3, or a newer patched version
  23. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  24. Watch Thrive Leads to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence.

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in Thrive Leads

All 2
More vulnerabilities in Thrive Leads
SeverityVulnerabilityCVEPublished
Medium5.3Missing Authorization
≤10.9.2Update to 10.9.2.1
CVE-2026-65435

Timeline

  1. CVE published

    Severity medium, CVSS 5.3

  2. Record last updated

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers
Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?