# Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via Google Fonts Inline Minify

- **ID:** WPSEC-2026-0894
- **Plugin:** Debloat – Remove Unused CSS, Optimize JS (`debloat`), https://wordpress.org/plugins/debloat/
- **Affected versions:** all versions before 1.4.0
- **Fixed in:** 1.4.0 (Update to 1.4.0 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/debloat
- **Fix released:** 2026-10-09
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0894/

## Description

The Debloat plugin for WordPress is vulnerable to Arbitrary File Read via the Google Fonts inline minify feature in all versions up to, and including, 1.3.0. This is due to the plugin treating any <link> tag in the page HTML that contains the word 'stylesheet' and a URL containing 'fonts.googleapis.com/css' as a Google Fonts stylesheet, fetching that URL with wp_remote_get() without restricting the host, and passing the response to the CSS minifier, which resolves @import rules against the local filesystem. The resulting content is cached in a publicly accessible directory and can be inlined into the page. This makes it possible for unauthenticated attackers to get the site to fetch its own pages that reflect attacker-supplied text, such as search feed links, and read the contents of arbitrary files on the server, such as wp-config.php. Exploitation requires the CSS optimization and Google Fonts inline options to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0894/
- https://plugins.svn.wordpress.org/debloat/tags/1.4.0/
- https://wordpress.org/plugins/debloat/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0894/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.