CVE-2021-24377

The Autoptimize plugin before version 2.7.8 contains a race condition vulnerability in its Import Settings feature that allows remote code execution. Although the plugin tries to delete malicious files from uploaded archives after extraction, an attacker can exploit a timing gap between when files are written to disk and when they are deleted to achieve code execution. This flaw represents a bypass of an earlier security fix from CVE-2020-24948.

Based on public CVE data (MITRE/NVD).