LWS Optimize – All-in-One Speed Booster & Cache Tools <= 4.1.6.5 - Unauthenticated Server-Side Request Forgery via Host Header
- ID
- WPSEC-2026-1020
- Plugin
- LWS Optimize – All-in-One Speed Booster & Cache Tools (lws-optimize)
- Affected
- from 4.0 before 4.1.7
- Remediation
- Update to 4.1.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- LWS Optimize – All-in-One Speed Booster & Cache Tools on WPSec AttackSurface
- Fix released
- Published
Description
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Server-Side Request Forgery via the HTTP Host header in versions 4.0 up to, and including, 4.1.6.5. This is due to the Critical CSS feature building the page URL it queues for background generation from the client-supplied Host header. The background job then requests that URL, and the stylesheets the returned page links to, from the server. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to reach internal services. Exploitation requires the Critical CSS feature to be enabled in the automatic or external mode, and the web server to pass requests with a modified Host header to WordPress.
References
- https://wpsec.com/vuln/WPSEC-2026-1020/
- https://plugins.svn.wordpress.org/lws-optimize/tags/4.1.7/
- https://wordpress.org/plugins/lws-optimize/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS