CVE-2026-12089 is a path traversal vulnerability (CWE-22) in the LWS Optimize – All-in-One Speed Booster & Cache Tools WordPress plugin up to version 3.3.19. The combine_current_css() function processes <link rel="stylesheet" href="..."> values from page HTML, converting same-site URLs to absolute filesystem paths. It then reads these files using file_get_contents() and Minify\CSS::add() without verifying that the resolved path remains within the WordPress ABSPATH or that the file has a .css extension. This lack of validation enables authenticated attackers with Editor-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact.

An attacker with Editor-level or higher privileges can exploit this vulnerability to read arbitrary files on the server hosting the WordPress site. This could lead to disclosure of sensitive information such as configuration files, credentials, or other data stored on the filesystem. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level access to trusted users only. Monitor for updates from the plugin vendor or WordPress security channels for a patch or official mitigation. Avoid using vulnerable versions (<=3.3.19) in production environments if possible.