blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24376

CRITICAL 9.8 CVSS 3.1
Published
June 21, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.

Affected WordPress components

  • Autoptimize Plugin · autoptimize
    Confirmed match Active
    From 2.7.8 (including) to 2.7.8 (excluding); Before 2.7.8
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Autoptimize — From 2.7.8 (including) to 2.7.8 (excluding)
  • autoptimize autoptimize — Before 2.7.8

References

  • wpscan.com https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record