PT-2021-15910 · WordPress · Autoptimize

Marcin Węgłowski · Published 2021-06-21 · Updated 2021-09-20 · CVE-2021-24377

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autoptimize WordPress plugin versions prior to 2.7.8

Description The issue arises from the insufficient protection against remote code execution (RCE) in the 'Import Settings' feature of the Autoptimize WordPress plugin. A race condition can occur between the time a potentially malicious file is extracted to the disk and the moment it is supposed to be removed, allowing for exploitation. This is a bypass of a previously known issue.

Recommendations For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue.

Exploit

Fix

RCE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2021-24377

Affected Products

Autoptimize

References · 4

• 🔥 https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a-1039343207e4 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24377 · Security Note
• https://t.me/cibsecurity/25587 · Telegram Post