What the vulnerability does
01Description
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.
Explanation of Vulnerability in Simple Terms
02Summary
LWS Optimize versions up to 3.3.19 contain a path traversal vulnerability that allows high-privilege users to read files outside the intended directory. An attacker with administrator or equivalent access can view sensitive files on the server by manipulating file paths. This does not allow file modification or deletion, only unauthorized file reading.
What an attacker can do
03Attacker Capabilities
Read arbitrary files on the server outside the plugin's intended directory.
Potential impact on your site
04Site Impact
A compromised admin account can expose sensitive configuration files, database credentials, or other private data stored on the server.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (administrator or equivalent role) on the site.
Key dates
06Disclosure timeline
June 13, 2026
CVE published
June 15, 2026
Record updated
