Description
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.
Published: 2026-10-16
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary File Read
Action: Patch Now
AI Analysis

Impact

The vulnerability is a directory traversal flaw in the Debloat WordPress plugin that allows an attacker to read arbitrary files on the server. If the Optimize CSS feature is enabled, a crafted 's' search parameter in a public search URL can expose sensitive files, including configuration or credential files, leading to confidentiality compromise.

Affected Systems

The affected product is the Debloat – Remove Unused CSS, Optimize JS plugin for WordPress, versions up to and including 1.3.0. WordPress sites running this plugin with the default Inline Google Fonts option active are at risk.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: an unauthenticated visitor can send a crafted GET request to the public search URL once the Optimize CSS feature is enabled, making the file read trivial. Attackers do not need elevated privileges beyond the plugin's configuration, though the initial setting is made by an administrator.

Generated by OpenCVE AI on October 16, 2026 at 13:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Debloat to a version newer than 1.3.0 to eliminate the directory traversal flaw.
  • If updating immediately is not possible, temporarily disable the Optimize CSS setting or the Inline Google Fonts option to prevent the vulnerability from being triggered.
  • Review server file permissions to ensure that files are not readable by unintended users and consider removing unused sensitive files.

Generated by OpenCVE AI on October 16, 2026 at 13:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Description The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.
Title Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T16:18:46.835Z

Reserved: 2026-10-02T13:02:55.637Z

Link: CVE-2026-104769

cve-icon Vulnrichment

Updated: 2026-10-16T16:18:39.505Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T04:18:23.037

Modified: 2026-10-16T17:17:21.457

Link: CVE-2026-104769

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:52:47Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')