CVE-2021-24220

CVE-2021-24220 is a critical arbitrary file upload vulnerability affecting multiple Thrive Themes WordPress themes, including FocusBlog, Ignition, Luxe, and others, all versions prior to 2.0.0. This flaw allows an unauthenticated attacker to exploit a REST API endpoint, intended for image compression, to upload malicious PHP files to the compromised website. The vulnerability has a CVSS score of 9.1 (Critical) due to its network-based attack vector, low attack complexity, and high impact on integrity and availability, enabling remote code execution. Attackers can leverage a crafted request, combined with an option update vulnerability, to retrieve and write malicious code from a remote URL, potentially overwriting existing files or creating new ones. While there is no evidence of active exploitation (KEV list) or Metasploit modules, Nuclei templates exist for this critical vulnerability, indicating potential for exploitation. Despite its severity, there is no community discussion or media coverage, suggesting low public awareness.