The LWS Optimize WordPress plugin, versions before 3.4, contains a missing capability check for its cache‑clearing operations. It allows any authenticated user—including Subscribers—to flush the site’s caches, forcing repeated cache rebuilds that can exhaust server resources and degrade site performance. This flaw is a missing authorization vulnerability (CWE‑862) where a privileged operation is exposed to insufficiently privileged users.

The vulnerability affects the LWS Optimize plugin in versions before 3.4, released by an unidentified vendor. No other vendors or product families are listed as impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score remains very low, with less than 1% likelihood of exploitation. It is not listed in the CISA KEV catalog. Any authenticated user can trigger the cache flush, leading to unnecessary rebuilds and potential denial of service via resource exhaustion. The lack of administrative context elevates the risk for larger sites that rely on caching for performance.