CVE-2021-24377: autoptimize

csirt@kutim:~/threat-intel/cve/CVE-2021-24377

CVSS 8.1 · High EPSS 1,2%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada autoptimize. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.

Rincian

Terbit di NVD: 21 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 66,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
autoptimize	autoptimize	Semua versi sebelum 2.7.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a-1039343207e4 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.