CVE-2026-12037: Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's domgettype setting has been configured to 'wpremotepost' by an administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the dom_get_type setting so it is not configured to 'wp_remote_post', the configuration under which the vulnerability is reachable.
Asset CleanUp: Page Speed Booster dom_get_type = not wp_remote_post
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Asset CleanUp: Page Speed Booster version 1.4.0.5 or earlier are affected only if an administrator has configured the plugin's dom_get_type setting to wp_remote_post.
What access does an attacker need to exploit it?
An attacker must already be authenticated with administrator-level access or higher. They exploit the issue through the page_url parameter.
What could exploitation allow?
An attacker can cause the WordPress application to send web requests to arbitrary locations. This can be used to query or modify information exposed by internal services.