CVE-2026-104769: WordPress Debloat Plugin Path Traversal

CVE-2026-104769 Overview

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.3.0. The flaw exists in the handling of the s parameter, allowing attackers to read arbitrary files on the server. Exploitation is possible when the site administrator has enabled the Optimize CSS feature with the default Inline Google Fonts option active. Once that configuration is in place, an unauthenticated visitor can trigger the issue with a single crafted GET request to the public search URL. The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Unauthenticated attackers can read the contents of arbitrary files on the server, including configuration files that may contain database credentials, API keys, and other sensitive secrets.

Affected Products

WordPress Debloat – Remove Unused CSS, Optimize JS plugin versions ≤ 1.3.0
WordPress sites with the Optimize CSS feature enabled
Installations using the default Inline Google Fonts option

Discovery Timeline

2026-10-16 - CVE-2026-104769 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104769

Vulnerability Analysis

The vulnerability resides in the stylesheet processing pipeline of the Debloat plugin. When the Optimize CSS feature is active with the Inline Google Fonts option enabled, the plugin exposes a public search endpoint that accepts the s query parameter. Input supplied through this parameter is passed into file-reading routines without proper sanitization or path validation.

Attackers can supply traversal sequences such as ../ to escape the intended directory and reference files outside the plugin's expected scope. The plugin then reads the targeted file during CSS processing and includes the contents in the response pipeline.

The EPSS score for this issue is 0.767%, placing it in the 55th percentile for exploitation probability. The relevant source code paths are documented in the WordPress plugin repository, including the stylesheet processing logic and the optimize CSS handler.

Root Cause

The plugin fails to validate or canonicalize the s parameter before using it as part of a file path operation. The input flows from an HTTP request into file-reading functions used by the CSS optimizer. No normalization filters directory traversal sequences, and no allowlist constrains the resolved path to the plugin cache directory.

Attack Vector

Exploitation requires that a site administrator enable the Optimize CSS feature with the default Inline Google Fonts option. Once configured, an unauthenticated attacker sends a single HTTP GET request to the public search URL. The crafted request supplies a traversal sequence in the s parameter that points to a sensitive file such as wp-config.php. The server returns the file contents through the plugin's response processing. See the Wordfence vulnerability report for additional analysis.

Detection Methods for CVE-2026-104769

Indicators of Compromise

Web server access logs containing requests to search URLs with ../ or encoded traversal sequences (%2e%2e%2f) in the s parameter
Unexpected read access to files such as wp-config.php, /etc/passwd, or files outside the plugin cache directory
HTTP 200 responses to search queries containing file path traversal payloads
Debloat plugin cache activity targeting absolute file system paths

Detection Strategies

Inspect WordPress query strings for the s parameter containing dot-dot sequences, URL-encoded traversal, or absolute path references
Review web application firewall logs for pattern matches on directory traversal signatures against the public search endpoint
Correlate requests to the search URL with subsequent file reads outside the WordPress document root

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward access logs to a centralized analytics platform
Alert on anomalous volumes of requests to the site search endpoint from single source addresses
Monitor file integrity on sensitive configuration files such as wp-config.php and track access events

How to Mitigate CVE-2026-104769

Immediate Actions Required

Update the Debloat plugin to a version later than 1.3.0 as soon as the vendor publishes a patch
Disable the Optimize CSS feature or the Inline Google Fonts option until a fix is applied
Review web server logs for prior exploitation attempts targeting the s parameter
Rotate any secrets stored in files that may have been exposed, including database credentials and API keys

Patch Information

The plugin maintainers have published a changeset addressing the issue. Site administrators should upgrade the Debloat plugin through the WordPress admin dashboard or by replacing the plugin files with the fixed release.

Workarounds

Deactivate the Debloat plugin entirely until a patched version is installed
Disable the Inline Google Fonts option within the Optimize CSS feature settings
Deploy a web application firewall rule blocking requests to search URLs that contain ../, ..\\, or encoded traversal sequences in the s parameter
Restrict file system permissions on sensitive configuration files to reduce the readability of secrets by the web server user

bash

# Example WAF rule blocking traversal in the s parameter
SecRule ARGS:s "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
    "id:1026104769,phase:2,deny,status:403,msg:'CVE-2026-104769 Debloat traversal attempt'"