Debloat Remove Unused Css Optimize Js
Monthly
Directory traversal in the WordPress plugin 'Debloat - Remove Unused CSS, Optimize JS' (all versions through 1.3.0) allows remote attackers to read arbitrary files on the server via crafted input in the 's' search parameter. According to our independent assessment, the CVSS vector is AV:N/AC:H/PR:N/UI:N (unauthenticated, no user interaction), so the trigger is a single crafted GET request to the public search endpoint - but only after a site administrator has enabled the plugin's 'Optimize CSS' feature with the default 'Inline Google Fonts' option active, which is why the attack is rated AC:H and conditional rather than universally exploitable. Impact is read-only confidentiality loss (C:H, I:N, A:N), typically exposing wp-config.php and other sensitive files subject to web-server/PHP file permissions; no public exploit code has been identified at time of analysis and there is no KEV listing, making this a moderate, conditionally-exploitable issue rather than a top-tier emergency.
Directory traversal in the WordPress plugin 'Debloat - Remove Unused CSS, Optimize JS' (all versions through 1.3.0) allows remote attackers to read arbitrary files on the server via crafted input in the 's' search parameter. According to our independent assessment, the CVSS vector is AV:N/AC:H/PR:N/UI:N (unauthenticated, no user interaction), so the trigger is a single crafted GET request to the public search endpoint - but only after a site administrator has enabled the plugin's 'Optimize CSS' feature with the default 'Inline Google Fonts' option active, which is why the attack is rated AC:H and conditional rather than universally exploitable. Impact is read-only confidentiality loss (C:H, I:N, A:N), typically exposing wp-config.php and other sensitive files subject to web-server/PHP file permissions; no public exploit code has been identified at time of analysis and there is no KEV listing, making this a moderate, conditionally-exploitable issue rather than a top-tier emergency.