‹ Back to list

CVE-2026-104769

Status: DeferredMedium (5.9)—
Severity5.9Medium · CVSS 3.1
Exploitation probability0.77 %higher than 55% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL.

CVSS

Base score
5.9
Version
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.77 %
Percentile among all scored CVEs
55
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:N (explotable por red sin privilegios) y el texto describe una GET única a la URL de búsqueda pública que lee archivos arbitrarios (CWE-22).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Debloat — DebloatAI

CWEs

References

Show 10 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-104769",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-104769",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T16:18:33.116556Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "asadkn",
          "product": "Debloat – Remove Unused CSS, Optimize JS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "1.3.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-16T04:18:23.037",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/file-cache.php#L97",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L161",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/minifier.php#L82",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/optimize-css.php#L221",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/optimize-css/stylesheet.php#L80",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/inc/process.php#L92",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/CSS.php#L207",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/debloat/tags/1.3.0/vendor/matthiasmullie/minify/src/Minify.php#L218",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3735830%40debloat&new=3735830%40debloat",
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=cve",
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires that the site administrator has enabled the Optimize CSS feature (with the default Inline Google Fonts option active), but once that condition is met the attack is trivially triggered by an unauthenticated visitor with a single crafted GET request to the public search URL."
    }
  ],
  "lastModified": "2026-10-16T17:17:21.457",
  "sourceIdentifier": "security@wordfence.com"
}