{
 "id": "WPSEC-2026-0894",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0894/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0894/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0894/index.md",
 "title": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via Google Fonts Inline Minify",
 "description": "The Debloat plugin for WordPress is vulnerable to Arbitrary File Read via the Google Fonts inline minify feature in all versions up to, and including, 1.3.0. This is due to the plugin treating any <link> tag in the page HTML that contains the word 'stylesheet' and a URL containing 'fonts.googleapis.com/css' as a Google Fonts stylesheet, fetching that URL with wp_remote_get() without restricting the host, and passing the response to the CSS minifier, which resolves @import rules against the local filesystem. The resulting content is cached in a publicly accessible directory and can be inlined into the page. This makes it possible for unauthenticated attackers to get the site to fetch its own pages that reflect attacker-supplied text, such as search feed links, and read the contents of arbitrary files on the server, such as wp-config.php. Exploitation requires the CSS optimization and Google Fonts inline options to be enabled.",
 "plugin": {
  "slug": "debloat",
  "name": "Debloat",
  "full_name": "Debloat – Remove Unused CSS, Optimize JS",
  "wordpress_org": "https://wordpress.org/plugins/debloat/",
  "advisories_url": "https://wpsec.com/vuln/plugin/debloat/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/debloat"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.0",
 "remediation": "Update to 1.4.0 or later.",
 "fix_released": "2026-10-09T03:35:24+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:13:12.025137+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0894/",
  "https://plugins.svn.wordpress.org/debloat/tags/1.4.0/",
  "https://wordpress.org/plugins/debloat/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/debloat",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}