In WordPress sites running LWS Optimize – All-in-One Speed Booster & Cache Tools up to and including version 3.3.19, the combine_current_css() function accepts stylesheet URLs extracted from page HTML and converts same-site paths to absolute filesystem paths without ensuring those paths remain inside the site’s root or that they end with a .css extension. This oversight allows an attacker who has been granted at least Editor role or higher to read the contents of any file on the server that the web server’s PHP process can reach, leading to a confidentiality compromise. The bug does not directly lead to code execution or privilege escalation, but the exposure of configuration files, core code, or sensitive data that resides on disk can be exploited in further attacks.

The vulnerability affects the plugin LWS Optimize – All-in-One Speed Booster & Cache Tools (all versions up to and including 3.3.19). Users who have installed any of these versions and rely on the plugin’s CSS aggregation feature are at risk.

The CVSS score is 4.9, indicating a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain. The attack vector is authenticated via a WordPress account with Editor privileges or higher. Because the exposed functionality reads files from the server, the impact is limited to confidentiality, but it can enable attackers to gather additional information that may facilitate more advanced attacks.