This vulnerability is present in versions of the OMGF WordPress plugin before 6.3.11. By sending a specially constructed HTTP request that calls the do_optimize action, an attacker can trigger a long server‑side loopback request. Because the action bypasses all authentication and nonce checks, anyone on the public internet can invoke it. The repetitive request loop consumes PHP worker processes until the pool is exhausted, resulting in a denial of service that can render the entire WordPress site unavailable.

The affected product is the OMGF WordPress plugin, also marketed as GDPR/DSGVO Compliant, Faster Google Fonts. Easy. All installations running a version earlier than 6.3.11 are vulnerable; newer releases contain the fix.

The EPSS score is < 1%, implying low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so there is no publicly known exploitation evidence. The CVSS score of 7.5 indicates a high severity. However, because the vulnerability does not require authentication and the resource‑intensive operation can be triggered by any remote attacker, exploitation is trivial for adversaries seeking to disrupt availability. If successful, the site can be taken offline for extended periods, potentially disrupting business and revenue.