CVE-2026-12089

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.

• CWE-22

• https://plugins.trac.wordpress.org/browser/lws-optimize/tags/3.3.19/Classes/Front/LwsOptimizeCSSManager.php#L289
• https://plugins.trac.wordpress.org/browser/lws-optimize/tags/3.3.19/Classes/Front/LwsOptimizeCSSManager.php#L61
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb80db2-753c-40fa-aee4-7d8c1749d037?source=cve

Published

Jun 13, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12082The Praison AI SEO WordPress plugin before 5.0.7 does not pe…7.5
• CVE-2026-12083The Admin and Site Enhancements (ASE) WordPress plugin befor…8.1
• CVE-2026-12084IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 thr…7.5
• CVE-2026-12085IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM …6.5
• CVE-2026-12086IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3…5.5
• CVE-2026-12087Socket versions before 2.041 for Perl have an out-of-bounds …9.1
• CVE-2026-12090The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-12093The Simple Membership plugin for WordPress is vulnerable to …5.3
• CVE-2026-12094The Advanced Contact Form 7 - Compact DB plugin for WordPres…5.3
• CVE-2026-12095The Kargo Takip plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-12097The User Management plugin for WordPress is vulnerable to au…5.3
• CVE-2026-12098The PowerPress Podcasting plugin by Blubrry plugin for WordP…6.4