CVE-2026-16042 describes a missing authorization vulnerability in the LWS Optimize WordPress plugin prior to version 3.4. The plugin does not verify user capabilities before allowing cache-clearing operations. Consequently, any authenticated user, regardless of role, can flush the site's caches, potentially causing performance degradation due to forced repeated cache rebuilds. No CVSS score or vendor remediation information is currently available.

Any authenticated user, including low-privilege roles such as Subscribers, can clear the site's cache. This can lead to performance issues and increased server load due to repeated cache rebuilds. There is no indication of direct data compromise or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for unusual cache-clearing activity if possible.