Debloat WordPress Plugin CVE-2026-104769

Exploitation requires that the site administrator has enabled the Debloat plugin's 'Optimize CSS' feature with the default 'Inline Google Fonts' option active; this is the specific, attacker-independent prerequisite. Once that configuration is present, an unauthenticated remote attacker (CVSS PR:N) triggers the flaw with a single crafted GET request to the public search endpoint, supplying directory-traversal input in the 's' parameter - no user interaction is required (UI:N). Limiting factors: the Optimize CSS feature is not guaranteed to be enabled by default on every install (hence AC:H), impact is read-only disclosure (C:H, I:N, A:N) so no code execution or data modification results directly, and successful reads are bounded by the web server/PHP process file permissions.

This is a moderate, conditionally-exploitable issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) models network reach with no authentication but high attack complexity, high confidentiality impact, and no integrity or availability impact - consistent with an unauthenticated arbitrary file read that only works once a specific optional feature is configured. There is a notable internal conflict in the source data: the NVD-style description text states the flaw affects 'authenticated attackers, with administrator-level access and above,' yet the same description and the CVSS PR:N both state the actual trigger is an unauthenticated visitor sending a single crafted GET request. The reconciliation is that administrator access is only needed to ENABLE the vulnerable configuration (Optimize CSS with Inline Google Fonts), after which exploitation itself is unauthenticated - this is why AC:H and PR:N coexist. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these signals plus the non-default configuration prerequisite and read-only impact argues against treating this as a widespread automated-exploitation priority. Prioritize for sites known to run the Debloat plugin with Optimize CSS enabled; deprioritize elsewhere.

On a WordPress site where the administrator has enabled the Debloat plugin's Optimize CSS feature with the default Inline Google Fonts option, an unauthenticated visitor sends a single crafted GET request to the public search URL, placing directory-traversal sequences in the 's' parameter. The minifier resolves that path and returns the contents of an arbitrary server file (e.g., wp-config.php), leaking database credentials and secret keys. No public exploit code is identified at time of analysis, and the high attack complexity reflects the required non-default configuration rather than any difficulty in the request itself.