CVE-2021-24376
📋 TL;DR
This vulnerability in the Autoptimize WordPress plugin allows attackers to upload malicious PHP files through the Import Settings feature, bypassing previous security fixes. Attackers can achieve remote code execution on vulnerable WordPress sites. All WordPress sites running Autoptimize plugin versions before 2.7.8 are affected.
💻 Affected Systems
- Autoptimize WordPress Plugin
📦 What is this software?
Autoptimize by Autoptimize
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, steal data, install backdoors, or pivot to other systems.
Likely Case
Website defacement, data theft, malware distribution, or cryptocurrency mining through uploaded PHP shells.
If Mitigated
No impact if plugin is patched or disabled, or if file uploads are properly restricted.
🎯 Exploit Status
Exploitation requires admin access to WordPress dashboard. Public exploit code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.8 and later
Vendor Advisory: https://wordpress.org/plugins/autoptimize/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin dashboard. 2. Go to Plugins → Installed Plugins. 3. Find Autoptimize and click 'Update Now'. 4. Verify version is 2.7.8 or higher.
🔧 Temporary Workarounds
Disable Import Settings Feature
allRemove or restrict access to the Import Settings functionality
Edit wp-config.php and add: define('AUTOPTIMIZE_DISABLE_IMPORT', true);
Disable Plugin
linuxTemporarily disable Autoptimize plugin until patched
wp plugin deactivate autoptimize
🧯 If You Can't Patch
- Restrict file uploads in WordPress to prevent PHP file execution
- Implement web application firewall rules to block malicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin dashboard → Plugins → Autoptimize version. If version is below 2.7.8, system is vulnerable.Check Version:
wp plugin get autoptimize --field=versionVerify Fix Applied:
Verify Autoptimize plugin version is 2.7.8 or higher in WordPress admin dashboard.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/cache/autoptimize/
- PHP file execution from unexpected locations
- Admin user importing settings with zip files
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=ao_import_settings
- Upload of zip files to WordPress admin endpoints
SIEM Query:
source="wordpress.log" AND ("ao_import_settings" OR "autoptimize import") AND file_extension="zip"