All vulnerabilities
CVE-2026-91828

OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

Unknown OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.3.11Fixed versionCVE List
Published2 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

  • 6.3.11OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

Text from CVE List

Affected versions 1

  • OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.affected: all versions before 6.3.11CVE List

References 1