PT-2021-3389 · WordPress · Autoptimize

Marcin Węgłowski · Published 2021-06-21 · Updated 2021-09-20 · CVE-2021-24376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autoptimize WordPress plugin versions prior to 2.7.8

Description The issue is related to the "Import Settings" feature of the Autoptimize WordPress plugin, which improperly handles the extraction of uploaded archives. This allows an attacker to upload a zip file containing a directory with a PHP file, bypassing the plugin's attempt to delete malicious files. The vulnerability enables remote code execution.

Recommendations For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue. As a temporary workaround, consider disabling the "Import Settings" feature until a patch is available. Restrict access to the uploaded archives and extracted folders to minimize the risk of exploitation. Avoid using the "Import Settings" functionality with untrusted sources until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

BDU:2021-03240

CVE-2021-24376

Affected Products

Autoptimize

References · 4

• 🔥 https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24376 · Security Note
• https://bdu.fstec.ru/vul/2021-03240 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24376 · Vendor Advisory