CVE-2020-24948

The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege…

published September 3, 2020

CVSS
—
EPSS
13%
Percentile
96.4
In the wild
Unconfirmed
What it is

The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13139 · 96.4th percentile
Published
2020-09-03T14:06Z
EPSS history
Timeline
  • 03 SEP 14:06Z
    The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege…
    cvelistv5