{"id":"CVE-2020-24948","published":"2020-09-03T14:06:10Z","modified":"2024-08-04T15:26:08Z","title":"The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a…","vendor":null,"product":null,"tier":"tail","description":{"text":"The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.13139,"percentile":0.96344,"provenance":"source"},"cwes":[],"references":[{"url":"https://wpvulndb.com/vulnerabilities/10372","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/160850/WordPress-Autoptimize-Shell-Upload.html","tags":["x_refsource_MISC"]}],"priority":{"score":24.3,"factors":[{"name":"EPSS percentile","points":19.27},{"name":"Public exploit code","points":5.0}]},"euvd":{"id":"EUVD-2020-17649","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160850/WordPress-Autoptimize-Shell-Upload.html"],"lineage":{"familyId":"fam-autoptimize-cve-2020-24948","children":[{"from":"CVE-2020-24948","to":"CVE-2021-24376","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"It is a bypass of CVE-2020-24948 which allows sending a PHP file via the \"Import Settings\" functionality to achieve Remote Code Execution.","from":"CVE.org","in":"CVE-2021-24376"}]},{"from":"CVE-2020-24948","to":"CVE-2021-24377","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"It is a bypass of CVE-2020-24948.","from":"CVE.org","in":"CVE-2021-24377"}]}]}}