Arbitrary File Read Vulnerability in LWS Optimize Plugin for WordPress
CVE-2026-12089

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Lws Optimize – All-in-one Speed Booster & Cache Tools
Vendor
CVE Published:
13 June 2026

What is CVE-2026-12089?

The LWS Optimize plugin for WordPress contains a vulnerability that allows authenticated attackers with Editor-level access and above to read arbitrary files from the server. This is due to improper handling of values, which enables the plugin to convert same-site URLs into absolute filesystem paths without ensuring that they remain within the legal filesystem boundary (ABSPATH) or that they have a .css extension. The flaw resides in the combine_current_css() function and affects all versions up to and including 3.3.19. Site owners are advised to update the plugin to mitigate the risk of sensitive data exposure.

Affected Version(s)

LWS Optimize – All-in-One Speed Booster & Cache Tools 0 <= 3.3.19

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/lws-optimize/t...
https://plugins.trac.wordpress.org/browser/lws-optimize/t...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Omar Elshopky
.