CVE-2020-24948

EUVD-2020-17649
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
autoptimizeautoptimize
𝑥
< 2.7.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/160850/WordPress-Autoptimize-Shell-Upload.html
https://wpvulndb.com/vulnerabilities/10372
http://packetstormsecurity.com/files/160850/WordPress-Autoptimize-Shell-Upload.html
https://wpvulndb.com/vulnerabilities/10372