Autoptimize <= 2.7.7 - Race Condition leading to Remote Code Execution
Strategic Overview
Vulnerability Overview
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
Technical Analysis
REMEDIATION: Update to version 2.7.8, or a newer patched version --- IDENTIFIER: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C