CVE-2026-45212
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Asset CleanUp: Page Speed Booster plugin (wp-asset-clean-up) by Gabe Livan (through 1.4.0.3) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may exploit the missing authorization to perform actions reserved for authorized users, potentially leading to unauthorized changes on the site.
Recommendation
Update the Asset CleanUp: Page Speed Booster plugin to a version later than 1.4.0.3 containing the fix.
Other vulnerabilities in Asset CleanUp: Page Speed Booster
See all- CVE-2026-66571High
The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.
- CVE-2026-13354High
The Asset CleanUp: Page Speed Booster plugin for WordPress (versions up to and including 1.4.0.5) is vulnerable to stored cross-site scripting via comment content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user visits the injected page. This is only exploitable when combine_loaded_css is enabled.
Original NVD description (English source)
Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.4.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS