EUVD-2026-51942
GHSA-6h82-r4vw-xr2m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Subscriber-level authentication required (PR:L); network accessible with no complexity (AV:N/AC:L); only availability impacted via cache exhaustion (A:L); no data exposure or integrity change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
AnalysisAI
Cache management actions in the LWS Optimize WordPress plugin before version 3.4 lack authorization checks, permitting any authenticated user - including low-privileged Subscribers - to flush the site's caches and trigger repeated, resource-intensive cache rebuilds. The vulnerability is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to availability degradation rather than data exposure or modification. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at a very low 0.13% (3rd percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation interest.
Technical ContextAI
WordPress enforces role-based access control through its capabilities system, where actions privileged to administrators should be gated by checks such as current_user_can('manage_options') before execution. CWE-862 (Missing Authorization) identifies the root cause: the LWS Optimize plugin's cache-clearing action handlers - likely registered AJAX endpoints or REST API routes - perform no capability verification before executing the flush operation. This means any authenticated WordPress session, regardless of role, satisfies the only access gate. The affected product is identified via CPE as cpe:2.3:a:unknown:lws_optimize:*:*:*:*:*:*:*:* for all versions prior to 3.4. Cache rebuilds are computationally expensive operations that query the database and regenerate static assets, making forced flushes an effective availability lever.
RemediationAI
Vendor-released patch: LWS Optimize version 3.4. Site administrators should update the plugin to 3.4 or later immediately via the WordPress admin dashboard or WP-CLI. The WPScan advisory at https://wpscan.com/vulnerability/0ea45a09-3155-4e47-97f7-f7645d583565/ confirms patch availability. If immediate patching is not possible, the most targeted compensating control is to disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining the Subscriber accounts needed to exploit this flaw; note this may limit intended site functionality. Alternatively, temporarily deactivating the LWS Optimize plugin eliminates the attack surface entirely at the cost of caching benefits.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today