CVE-2026-12089: WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combinecurrentcss() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with filegetcontents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
LWS Optimize – All-in-One Speed Booster & Cache Toolsfrom your environment.Uninstall the affected plugin if it is not required to eliminate the vulnerable code path.
- Configuration
Modify the plugin's combine_current_css() behaviour so that any same-site URLs resolved to filesystem paths are validated: ensure the resolved path remains inside ABSPATH (no directory traversal outside the webroot) and that the file has a .css extension before calling file_get_contents() or Minify\CSS::add(). Reject or skip any paths that fail validation.
LWS Optimize – All-in-One Speed Booster & Cache Tools (combine_current_css) CSS path resolution validation = enforce resolved path within ABSPATH and require .css extension - Configuration
Disable the plugin's CSS combining/merging/optimization feature (the functionality that invokes combine_current_css()) in plugin settings to prevent processing of <link rel="stylesheet"> href values until a coded remediation is applied.
LWS Optimize – All-in-One Speed Booster & Cache Tools CSS combine/merge feature = disabled - Compensating control
Limit and audit Editor-level and higher user accounts: restrict Editor+ privileges to trusted administrators, remove or reassign unnecessary Editor accounts, and enforce strong account hygiene to reduce risk from authenticated attackers.
- Operational
Audit webserver and WordPress logs for suspicious file reads or unexpected access patterns involving the plugin; investigate any indications of exploitation and remediate exposed data or compromised sites.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12089?
The severity of CVE-2026-12089 is rated as medium with a score of 4.9.
How do I fix CVE-2026-12089?
To fix CVE-2026-12089, update the LWS Optimize – All-in-One Speed Booster & Cache Tools plugin to version 3.3.20 or later.
What type of vulnerability is CVE-2026-12089?
CVE-2026-12089 is a path traversal vulnerability allowing authenticated users to read arbitrary files.
Who is affected by CVE-2026-12089?
Any WordPress site using the LWS Optimize – All-in-One Speed Booster & Cache Tools plugin version 3.3.19 or earlier is affected by CVE-2026-12089.
What is the impact of CVE-2026-12089?
The impact of CVE-2026-12089 can lead to unauthorized file access and exposure of sensitive information.