| Package | Affected versions | Patched versions |
|---|---|---|
| autoptimize | < 2.7.7 | 2.7.7 |
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free