Directory Traversal Vulnerability in Debloat Plugin for WordPress

CVE-2026-104769

What is CVE-2026-104769?

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level access or higher to exploit a Directory Traversal issue via the 's' parameter. This vulnerability permits the reading of sensitive files on the server. This exploitation scenario requires the site administrator to have the Optimize CSS feature enabled with the Inline Google Fonts option active. Once activated, an unauthenticated visitor can trigger the attack using a specially crafted GET request to the public search URL.

References