Vulnerability · Published Jun 21, 2021 · Assigned by WPScan

CVE-2021-24376Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"

Critical 9.8

In plain English

A critical-severity unrestricted file upload in Autoptimize from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)3.7%top 10.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Autoptimize	2.7.8 – before 2.7.8

Weakness: CWE-434

References

https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e x_refsource_CONFIRM