CVE-2026-104769: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in asadkn Debloat – Remove Unused CSS, Optimize JS

CVE-2026-104769 is a directory traversal vulnerability (CWE-22) in the Debloat – Remove Unused CSS, Optimize JS WordPress plugin by asadkn. Versions up to and including 1.3.0 are affected. The flaw exists in the handling of the 's' parameter, allowing an attacker with administrator privileges to read arbitrary files on the server. Exploitation requires that the Optimize CSS feature is enabled with the default Inline Google Fonts option active. Once these conditions are met, an unauthenticated visitor can trigger the vulnerability via a crafted GET request to the public search URL.

An attacker with administrator-level access can read arbitrary files on the server, potentially exposing sensitive information. The vulnerability requires specific plugin configuration (Optimize CSS with Inline Google Fonts enabled) and administrator privileges to exploit. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the Optimize CSS feature or the Inline Google Fonts option to mitigate the risk. Restricting administrator access and monitoring plugin configurations can reduce exposure.