CVE-2026-12089 is a path traversal vulnerability (CWE-22) in the LWS Optimize – All-in-One Speed Booster & Cache Tools WordPress plugin, affecting versions up to and including 3.3.19. The vulnerability exists in the combine_current_css() function, which processes <link rel="stylesheet" href="..."> elements from page HTML. It converts same-site URLs to absolute filesystem paths and reads them using file_get_contents() and Minify\CSS::add() without verifying that the resolved path remains within the WordPress ABSPATH or that the file has a .css extension. This improper validation allows authenticated attackers with Editor or higher privileges to read arbitrary files on the server.

An attacker with Editor-level or higher privileges can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information such as configuration files, credentials, or other protected data. The vulnerability does not allow code execution or modification, but the confidentiality impact is high. The CVSS v3.1 base score is 4.9 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level access to trusted users only and monitor for suspicious activity. Avoid using this plugin version in high-risk environments. Follow the vendor's updates closely for any released patches or official mitigations.