CVE-2021-24377

Autoptimize < 2.7.8 - Race Condition leading to RCE

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.

We have discovered 949 live websites that are affected by CVE-2021-24377.

Run a Free Instant Scan



Affected Software

Product  Autoptimize
Category Widgets
Vulnerable Domains949 live websites (1.29% of Autoptimize install base)
Vulnerable Versions
  • from 2.7.8 through 2.7.8
Vulnerable Versions Count1 versions ( less than 0.1% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - Jun 21, 2021
  • Updated - Aug 3, 2024

Credits

  • Marcin Węgłowski

Website Distribution by Country

Number of websites using CVE-2021-24377
United States152 websites


Germany143 websites
Russia104 websites
Japan97 websites
Poland59 websites
France52 websites
GB34 websites
Italy31 websites
Spain24 websites
Netherlands22 websites

Website Distribution by TLD

Number of websites using CVE-2021-24377
.com282 websites
.de113 websites
.ru78 websites
.pl41 websites
.org31 websites
.jp29 websites
.fr25 websites
.co.uk24 websites
.net24 websites
.it23 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-24377

Top websites that are affected by CVE-2021-24377. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
*******.com United States***,***
****************.com GB***,***
***.scot GB***,***
********.ca United States***,***
*******************.com Canada***,***
*******************.com United States***,***
**********.com United States***,***
***************.be Netherlands***,***
*****.pl Poland***,***
See full domain list

FAQ

CVE-2021-24377 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Autoptimize
A total of 949 websites have been identified as vulnerable to CVE-2021-24377, based on global website indexing conducted by WebTechSurvey.
The Autoptimize is affected by the CVE-2021-24377 vulnerability.
Autoptimize versions up to and including 2.7.8 are vulnerable to CVE-2021-24377.