Asset CleanUp CVE-2026-66571

Exploitation requires an authenticated WordPress user (typically an administrator with access to Asset CleanUp settings) to be socially engineered into visiting an attacker-controlled page while their session is active (UI:R). It targets a plugin admin action on Asset CleanUp: Page Speed Booster <= 1.4.0.5 that lacks CSRF nonce protection. Limiting factors: no exploitation is possible without victim interaction and an existing privileged session, the specific action must be reachable by the victim's role, and there is no server-side authentication bypass - the attacker never gains direct access, only rides the victim's session.

This is a moderate, not top-tier, priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) leans on a scope change and low impact across all three CIA dimensions, which is generous for a CSRF: the attacker cannot act directly but must lure an authenticated victim (UI:R) into loading a crafted page, and the realistic effect is a state-changing settings action performed as the victim, i.e. predominantly an integrity issue. I disagree with the S:C and the C:L/A:L; a typical Asset CleanUp settings-change CSRF is integrity-centric, which brings my independent score down to roughly 4.3. No EPSS score, no CISA KEV entry, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' CSRF requires social-engineering a logged-in admin and defeats no protection if the victim never visits attacker content, so despite the 7.1 headline this is a lower real-world risk than the number implies. Data is single-sourced (Patchstack/EUVD); the precise vulnerable action is not detailed in the description, which limits confidence in the exact impact.

An attacker crafts a malicious web page containing an auto-submitting form or forged request targeting an unprotected Asset CleanUp admin action, then lures a logged-in WordPress administrator to visit it. Because the plugin action lacks CSRF nonce validation, the victim's browser silently performs the state change (e.g. altering asset/optimization settings) using their authenticated session. No public POC was provided for this entry.