CVE-2026-12037 is a Server-Side Request Forgery (SSRF) vulnerability in the Asset CleanUp: Page Speed Booster WordPress plugin affecting all versions up to 1.4.0.5. The vulnerability is triggered through the 'page_url' parameter when the 'dom_get_type' setting is set to 'wp_remote_post'. Exploitation requires authenticated administrator-level access. Successful exploitation enables attackers to make web requests to arbitrary locations from the server, which can be used to interact with internal services and potentially modify information.

An attacker with administrator privileges can exploit this SSRF vulnerability to make arbitrary HTTP requests from the web server to internal or external systems. This can lead to unauthorized querying and modification of internal service data. The vulnerability does not directly allow remote code execution or denial of service but can be leveraged to gather sensitive information or pivot within the internal network.

No official patch or fix is currently documented. Since exploitation requires the 'dom_get_type' setting to be configured to 'wp_remote_post', administrators should verify and, if possible, avoid this configuration to mitigate risk. Additionally, restricting administrator access to trusted users reduces the attack surface. Monitor the vendor's advisory channels for updates or patches addressing this vulnerability.