CVE-2021-24377
Autoptimize < 2.7.8 - Race Condition leading to RCE
- State
- Published
- Severity
- Not scored
- Published
- Jun 21, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
Scores
The record has no CVSS score.
Weaknesses
- CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
Affected Products
| Product | Versions |
|---|---|
AutoptimizeUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.