{
 "id": "WPSEC-2026-1020",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1020/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1020/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1020/index.md",
 "title": "LWS Optimize – All-in-One Speed Booster & Cache Tools <= 4.1.6.5 - Unauthenticated Server-Side Request Forgery via Host Header",
 "description": "The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Server-Side Request Forgery via the HTTP Host header in versions 4.0 up to, and including, 4.1.6.5. This is due to the Critical CSS feature building the page URL it queues for background generation from the client-supplied Host header. The background job then requests that URL, and the stylesheets the returned page links to, from the server. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to reach internal services. Exploitation requires the Critical CSS feature to be enabled in the automatic or external mode, and the web server to pass requests with a modified Host header to WordPress.",
 "plugin": {
  "slug": "lws-optimize",
  "name": "LWS Optimize – All-in-One Speed Booster & Cache Tools",
  "full_name": "LWS Optimize – All-in-One Speed Booster & Cache Tools",
  "wordpress_org": "https://wordpress.org/plugins/lws-optimize/",
  "advisories_url": "https://wpsec.com/vuln/plugin/lws-optimize/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/lws-optimize"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0",
    "from_inclusive": true,
    "to": "4.1.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0 before 4.1.7"
  ]
 },
 "introduced_in": "4.0",
 "fixed_in": "4.1.7",
 "remediation": "Update to 4.1.7 or later.",
 "fix_released": "2026-10-14T12:44:38+00:00",
 "published": "2026-10-15T12:51:52+00:00",
 "updated": "2026-10-14T19:51:33.087224+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1020/",
  "https://plugins.svn.wordpress.org/lws-optimize/tags/4.1.7/",
  "https://wordpress.org/plugins/lws-optimize/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/lws-optimize",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}