Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via Google Fonts Inline Minify
- ID
- WPSEC-2026-0894
- Plugin
- Debloat – Remove Unused CSS, Optimize JS (debloat)
- Affected
- all versions before 1.4.0
- Remediation
- Update to 1.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Debloat on WPSec AttackSurface
- Fix released
- Published
Description
The Debloat plugin for WordPress is vulnerable to Arbitrary File Read via the Google Fonts inline minify feature in all versions up to, and including, 1.3.0. This is due to the plugin treating any <link> tag in the page HTML that contains the word 'stylesheet' and a URL containing 'fonts.googleapis.com/css' as a Google Fonts stylesheet, fetching that URL with wp_remote_get() without restricting the host, and passing the response to the CSS minifier, which resolves @import rules against the local filesystem. The resulting content is cached in a publicly accessible directory and can be inlined into the page. This makes it possible for unauthenticated attackers to get the site to fetch its own pages that reflect attacker-supplied text, such as search feed links, and read the contents of arbitrary files on the server, such as wp-config.php. Exploitation requires the CSS optimization and Google Fonts inline options to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0894/
- https://plugins.svn.wordpress.org/debloat/tags/1.4.0/
- https://wordpress.org/plugins/debloat/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS