All vulnerabilities
CVE-2026-12037

Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

gabelivan Asset CleanUp: Page Speed Booster
Open in ThreatlineRecord JSON
CVSS
5.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.

Text from CVE List

Affected versions 1

  • Asset CleanUp: Page Speed Boosteraffected: all versions through 1.4.0.5CVE List

References 8