CVE-2026-12089
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The LWS Optimize plugin for WordPress up to version 3.3.19 is vulnerable to arbitrary file read. The combine_current_css() function trusts href values from <link> tags in page HTML and converts same-site URLs to absolute filesystem paths before reading them without verifying that the path stays within ABSPATH or has a .css extension. This allows authenticated attackers with Editor-level access and above to read arbitrary files.
Risk Assessment
The risk involves the possibility of reading sensitive system files by an attacker with editor privileges, which could lead to leakage of configuration data or other confidential information.
Recommendation
It is recommended to update the LWS Optimize plugin to the latest available version that fixes the arbitrary file read vulnerability.
Other vulnerabilities in LWS Optimize
See all- CVE-2026-16032Medium
The LWS Optimize WordPress plugin before version 4.1.2 improperly escapes a value submitted through an unauthenticated analytics endpoint before storing and rendering it in the admin dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
- CVE-2026-16042Medium
The LWS Optimize WordPress plugin before version 3.4 does not perform a capability check on its cache-clearing actions. Any authenticated user, including Subscribers, can flush the site's caches and force repeated cache rebuilds.
Original NVD description (English source)
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.