Input validation vulnerability in Autoptimize 2.1.0

The Autoptimize plugin for WordPress is vulnerable to a security issue called Local File Inclusion. This means that in versions up to and including 2.1.0, unauthenticated attackers are able to include and execute any files they want on the server. This means that any PHP code in those files will be executed, allowing attackers to bypass access controls, get sensitive data, or even run code if they are able to upload images and other “safe” file types. In order for this vulnerability to be exploited, the JS and CSS aggregation options must be turned on, as well as the ‘Also aggregate inline CSS’ option.