published June 21, 2021
⚠️ A sneaky exploit lets you upload an unfiltered zip file containing PHP scripts to WordPress without a hitch! 🚨 Think of it like a hotel that checks the contents of luggage but ignores what’s tucked away in sneaky corners. Just because the bellhop sees a suitcase doesn’t mean they’ll check what’s inside! This oversight could allow an attacker to snuggle a malicious PHP file right into your server, potentially leading to remote code execution. If they get control, they could manipulate your site or steal sensitive information, creating chaos without anyone the wiser!
Think of it like a hotel that checks the contents of luggage but ignores what’s tucked away in sneaky corners. Just because the bellhop sees a suitcase doesn’t mean they’ll check what’s inside! The Autoptimize plugin's "Import Settings" feature fails to properly scan extracted directories, allowing PHP files to remain on the server after a zip upload. This bypasses an earlier vulnerability (CVE-2020-24948) designed to prevent exactly this sort of issue.
This oversight could allow an attacker to snuggle a malicious PHP file right into your server, potentially leading to remote code execution. If they get control, they could manipulate your site or steal sensitive information, creating chaos without anyone the wiser! Update the Autoptimize plugin to version 2.7.8 or later immediately to close this gap. Additionally, review your upload policies to ensure rigorous checks are in place for file types and extensions. Regular audits will help maintain security! You've got this! Follow these steps to keep your site safe and sound! 🛡️