CVE-2026-12089: LWS Optimize Path Traversal Vulnerability

CVE-2026-12089 Overview

CVE-2026-12089 is an arbitrary file read vulnerability affecting the LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress in versions up to and including 3.3.19. The flaw resides in the combine_current_css() function, which trusts <link rel="stylesheet" href="..."> values harvested from page HTML. The function converts same-site URLs to absolute filesystem paths and reads them with file_get_contents() and Minify\CSS::add() without validating that the resolved path remains within ABSPATH or carries a .css extension. Authenticated attackers with Editor-level access or higher can leverage this behavior to read arbitrary files from the host filesystem. The issue is classified as [CWE-22] Path Traversal.

Critical Impact
Authenticated Editor-level users can read arbitrary files on the WordPress server, including configuration files containing database credentials and secret keys.

Affected Products

LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress
All plugin versions up to and including 3.3.19
WordPress sites permitting Editor or higher role access to untrusted users

Discovery Timeline

2026-06-13 - CVE-2026-12089 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12089

Vulnerability Analysis

The LWS Optimize plugin combines CSS assets referenced by a rendered page to reduce HTTP requests. During this process, combine_current_css() parses the page HTML and extracts href values from <link rel="stylesheet"> tags. The plugin then resolves same-site URLs into absolute filesystem paths and passes them to file_get_contents() and the Minify\CSS::add() method.

The resolver does not constrain the target path to the WordPress installation directory referenced by the ABSPATH constant. It also fails to verify that the resolved file has a .css extension. An attacker who controls page output, such as a post, page, or template editable at the Editor role, can inject a crafted stylesheet link that points to an arbitrary local file. When the optimization routine processes the page, it reads the targeted file and emits its contents through the generated combined CSS asset.

Root Cause

The root cause is insufficient input validation on attacker-influenced URLs prior to filesystem resolution. The plugin assumes that href values harvested from rendered HTML are trustworthy stylesheet references. No allowlist enforces containment within ABSPATH, and no extension check rejects non-CSS targets. This violates the principle of validating untrusted input before performing file operations.

Attack Vector

Exploitation requires authenticated access with Editor or higher privileges. The attacker injects a <link rel="stylesheet"> element whose href points to a sensitive file path under the same site origin. When the page is rendered and the CSS combine routine runs, the plugin reads the referenced file and includes its contents in the cached, combined output. The attacker then retrieves the combined CSS file to obtain the contents of files such as wp-config.php, .env, or other readable assets accessible to the PHP process.

The vulnerability is described in the Wordfence Vulnerability Report and the affected logic is visible in the LwsOptimizeCSSManager.php source at line 289 and line 61.

Detection Methods for CVE-2026-12089

Indicators of Compromise

Combined or cached CSS files in the LWS Optimize cache directory containing non-CSS content, PHP source code, or environment variable strings.
Editor-role accounts modifying posts, pages, or templates to embed <link rel="stylesheet"> elements pointing to absolute or traversal paths.
Outbound HTTP requests from anonymous or low-privilege visitors fetching combined CSS artifacts shortly after Editor content edits.

Detection Strategies

Inspect generated CSS cache files for content that is not valid CSS, such as PHP open tags, INI directives, or recognizable secrets like DB_PASSWORD or AUTH_KEY.
Review WordPress audit logs for posts or templates containing stylesheet links with suspicious href values referencing wp-config.php, /etc/, or traversal sequences.
Compare LWS Optimize plugin version against 3.3.19 across managed WordPress estates.

Monitoring Recommendations

Enable file integrity monitoring on the LWS Optimize cache directory and alert on cached files whose contents fail CSS validation.
Log and review all role changes that grant Editor or higher privileges and correlate with subsequent edits referencing external stylesheet links.
Monitor web server access logs for repeated retrieval of files in the plugin cache path immediately following authenticated content edits.

How to Mitigate CVE-2026-12089

Immediate Actions Required

Update the LWS Optimize plugin to a release later than 3.3.19 as soon as a patched version is published by the vendor.
Audit Editor and higher role assignments and remove access for accounts that do not require it.
Rotate WordPress secrets, database credentials, and any API keys stored in wp-config.php if exploitation is suspected.

Patch Information

No fixed version is listed in the NVD record at publication. Site operators should track the LWS Optimize plugin repository and the Wordfence Vulnerability Report for an updated release that constrains resolved paths to ABSPATH and enforces a .css extension check.

Workarounds

Deactivate the LWS Optimize plugin until a patched version becomes available.
Restrict Editor role assignments to trusted users only, since the vulnerability requires authenticated high-privilege access.
Configure a web application firewall rule to block requests that publish content containing stylesheet links resolving outside the site web root.
Set restrictive filesystem permissions so the PHP process cannot read files such as wp-config.php from unexpected paths where feasible.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate lws-optimize
wp plugin status lws-optimize