Junglewise Threat Intelligence

CVE-2026-12089: LWS Optimize WordPress plugin arbitrary file read in combine_current_css

CVE-2026-12089 · Severity: medium · CVSS 4.9 · Published 2026-06-13

Executive brief

The LWS Optimize plugin for WordPress, which is used to improve website loading speeds and manage caching, contains a security flaw that allows certain authorized users to access sensitive files. Specifically, users with Editor-level permissions or higher can exploit this vulnerability to read internal system files that they should not have access to. This could lead to the exposure of configuration details or other private data stored on the web server.

Technical details

The vulnerability exists in the combine_current_css() function within the LwsOptimizeCSSManager.php class. The function harvests stylesheet URLs from page HTML and converts same-site URLs into absolute filesystem paths to be processed by file_get_contents() or Minify\CSS::add(). Because the plugin fails to validate that the resolved path remains within the WordPress root directory (ABSPATH) or that the file has a .css extension, an attacker can perform a path traversal attack. This requires authenticated access with at least Editor-level privileges. Successful exploitation allows the attacker to read the contents of arbitrary files on the server.

Affected products

  • LWS Optimize LWS Optimize – All-in-One Speed Booster & Cache Tools up to, and including, 3.3.19

Timeline

  • 2026-06-13: advisory: NVD publication date

References