CVE-2026-45212 Overview
CVE-2026-45212 is a missing authorization vulnerability [CWE-862] in the Asset CleanUp: Page Speed Booster WordPress plugin developed by Gabe Livan. The flaw affects all versions up to and including 1.4.0.3 of the wp-asset-clean-up plugin. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should be restricted. The issue is exploitable over the network without authentication or user interaction. Successful exploitation results in a limited availability impact on the affected WordPress site, without directly compromising confidentiality or integrity of stored data.
Critical Impact
Unauthenticated network-based attackers can invoke restricted plugin actions, leading to a limited availability impact on affected WordPress installations running Asset CleanUp through version 1.4.0.3.
Affected Products
- Gabe Livan Asset CleanUp: Page Speed Booster (wp-asset-clean-up) — versions through 1.4.0.3
- WordPress sites with the plugin installed and activated
- Any hosting environment exposing the affected plugin endpoints to the public internet
Discovery Timeline
- 2026-05-12 - CVE-2026-45212 published to the National Vulnerability Database (NVD)
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-45212
Vulnerability Analysis
The vulnerability resides in the Asset CleanUp: Page Speed Booster plugin, which manages script and stylesheet loading to optimize WordPress page performance. The plugin exposes functionality without enforcing proper authorization checks on requests. An unauthenticated attacker can send crafted HTTP requests to the affected endpoints and trigger actions intended for privileged users. Because the plugin manages asset loading behavior, abuse of these endpoints can interfere with how a site serves resources to visitors. The vulnerability is classified under [CWE-862: Missing Authorization], indicating that the application does not perform an authorization check when an actor attempts to access a resource or perform an action.
Root Cause
The root cause is broken access control within plugin request handlers. The code paths invoked by HTTP requests fail to verify that the caller holds the required WordPress capability or nonce before executing privileged operations. This results from incorrectly configured access control security levels, where authentication or capability checks are either missing entirely or applied inconsistently across handlers in versions up to 1.4.0.3.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker issues HTTP requests directly to vulnerable plugin endpoints exposed by the WordPress site. Because the handler does not validate the requester's permissions, the action executes with the privileges of the plugin context. The result is a limited availability impact, consistent with the CVSS profile of the issue. No verified proof-of-concept exploit is currently published, and the EPSS score remains low. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2026-45212
Indicators of Compromise
- Unexpected HTTP POST or GET requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php referencing Asset CleanUp actions from unauthenticated sessions
- Anomalous changes to plugin settings or cached asset configurations without corresponding administrator login events
- Requests to plugin endpoints originating from IP addresses with no prior authentication history
Detection Strategies
- Inspect web server access logs for requests targeting wp-asset-clean-up action parameters that lack valid WordPress authentication cookies or nonces
- Correlate plugin configuration changes against authenticated administrator activity in WordPress audit logs
- Deploy web application firewall (WAF) rules that flag unauthenticated invocations of Asset CleanUp AJAX or admin-post actions
Monitoring Recommendations
- Enable verbose request logging on WordPress sites running Asset CleanUp until the plugin is updated
- Monitor for spikes in 200-status responses to plugin endpoints from unauthenticated clients
- Track plugin version inventory across managed WordPress instances and alert when version <= 1.4.0.3 is detected
How to Mitigate CVE-2026-45212
Immediate Actions Required
- Update Asset CleanUp: Page Speed Booster to a version newer than 1.4.0.3 as soon as the vendor publishes a fixed release
- Audit WordPress sites to identify installations running the vulnerable plugin version
- Restrict access to wp-admin paths using IP allowlists or authentication proxies where feasible
Patch Information
At the time of publication, the advisory lists affected versions through 1.4.0.3. Administrators should consult the Patchstack WordPress Vulnerability Advisory and the official WordPress plugin repository for the latest patched release and apply it across all affected sites.
Workarounds
- Deactivate the Asset CleanUp: Page Speed Booster plugin until a patched version is installed
- Apply WAF rules that block unauthenticated requests to plugin-specific action parameters
- Limit access to the WordPress administrative interface using network-layer controls or HTTP basic authentication
# Example WAF rule snippet to block unauthenticated Asset CleanUp action requests
SecRule REQUEST_URI "@rx /wp-admin/admin-(ajax|post)\.php" \
"chain,deny,status:403,id:1026045212,msg:'Block unauthenticated Asset CleanUp action - CVE-2026-45212'"
SecRule ARGS:action "@rx wpacu_" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
