CVE-2021-24377CWE-362

Autoptimize < 2.7.8 - Race Condition leading to RCE

published June 21, 2021

CVSS
—
EPSS
1%
Percentile
67.5
In the wild
Unconfirmed
What it is

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01183 · 67.5th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2021-06-21T19:18Z
EPSS history
Timeline
  • 21 JUN 19:18Z
    Autoptimize < 2.7.8 - Race Condition leading to RCE
    cvelistv5