CVE-2021-24220

CVE-2021-24220 is tied to Thrive Themes Legacy plugins/themes (up to 2.0.0) that expose a REST endpoint (kraken) used to compress images. The flaw arises when crafted requests, combined with data inserted via an Option Update vulnerability, allow remote retrieval of code from a URL and writing fi...

CVE-2021-24219

The CVE-2021-24219 entry concerns a REST API endpoint in Thrive Themes plugins/themes (e.g., Thrive Optimize and related plugins, and several Thrive Themes themes) that was intended to require an API key for access but could be reached with an empty api_key parameter when Zapier was not enabled. ...