CVE-2021-24377: Autoptimize < 2.7.8 - Race Condition leading to RCE
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24377?
CVE-2021-24377 has been rated as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2021-24377?
To fix CVE-2021-24377, update the Autoptimize plugin to version 2.7.8 or later.
What does CVE-2021-24377 exploit?
CVE-2021-24377 exploits a race condition that can result in remote code execution when using the 'Import Settings' feature of the Autoptimize plugin.
Which versions of Autoptimize are affected by CVE-2021-24377?
CVE-2021-24377 affects all versions of the Autoptimize WordPress plugin prior to 2.7.8.
Is CVE-2021-24377 a common vulnerability?
CVE-2021-24377 is considered a notable vulnerability due to its implications for WordPress security and the widespread use of the Autoptimize plugin.