Executive brief
LWS Optimize is a WordPress plugin that manages website caching to improve performance. A flaw in versions before 3.4 allows any logged-in user, even those with minimal permissions (Subscribers), to repeatedly clear the site's caches without administrative authorization. An attacker could trigger repeated cache rebuilds, degrading site performance and availability for legitimate users.
Technical details
The LWS Optimize WordPress plugin fails to perform a capability check on its cache-clearing AJAX actions (lws_clear_fb_cache, lws_clear_opcache, lws_clear_html_fb_cache, lws_clear_style_fb_cache, and lws_clear_currentpage_fb_cache). The vulnerability is a missing authorization check (CWE-862). An authenticated attacker with Subscriber-level privileges can extract a valid nonce from the frontend admin bar script block and invoke these actions via AJAX to flush the site's file-based cache. Exploitation requires only an authenticated user account and network access to wp-admin/admin-ajax.php; no admin credentials are needed. An attacker can repeatedly trigger cache-clearing to force the site to repeatedly rebuild caches, causing transient performance degradation and availability impact. Version 3.4 fixed this by adding a centralized capability gate requiring manage_options for these actions.
Affected products
- LWS Optimize before 3.4
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched: Fix released in version 3.4