CVE-2020-24948
📋 TL;DR
This vulnerability allows authenticated WordPress administrators to upload arbitrary files through the Autoptimize plugin's AJAX interface, bypassing file type validation. Attackers can upload PHP files leading to remote code execution on the server. Only WordPress sites running the vulnerable Autoptimize plugin version are affected.
💻 Affected Systems
- WordPress Autoptimize Plugin
📦 What is this software?
Autoptimize by Autoptimize
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining persistent access, data exfiltration, and lateral movement within the network.
Likely Case
Website defacement, malware injection, backdoor installation, and credential theft from the compromised WordPress instance.
If Mitigated
Limited to authenticated admin users only, reducing attack surface if proper access controls are enforced.
🎯 Exploit Status
Exploit requires WordPress administrator credentials. Public exploit code available in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.7 and later
Vendor Advisory: https://wordpress.org/plugins/autoptimize/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Autoptimize and click 'Update Now'. 4. Verify version is 2.7.7 or higher.
🔧 Temporary Workarounds
Disable Autoptimize Plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate autoptimize
Restrict AJAX Access
allBlock access to the vulnerable AJAX endpoint via web server configuration
# Apache: <LocationMatch "\/wp-admin\/admin-ajax\.php\?action=ao_ccss_import">\n Deny from all\n</LocationMatch>
# Nginx: location ~* \/wp-admin\/admin-ajax\.php\?action=ao_ccss_import {\n deny all;\n}
🧯 If You Can't Patch
- Remove administrator privileges from untrusted users
- Implement web application firewall rules to block file uploads to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Autoptimize for version 2.7.6 or earlierCheck Version:
wp plugin get autoptimize --field=versionVerify Fix Applied:
Confirm Autoptimize version is 2.7.7 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=ao_ccss_import
- File uploads of .php files via AJAX endpoints
- Unusual file creation in WordPress uploads directory
Network Indicators:
- HTTP POST to admin-ajax.php with zip file uploads
- Unexpected outbound connections from web server
SIEM Query:
source="web_server" AND (url="*admin-ajax.php*action=ao_ccss_import*" OR file_extension="php" AND upload_action="ao_ccss_import")