Description

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-25T08:16:38.490Z",
  "pubdate": "2026-09-25T08:16:38.490Z",
  "executiveSummary": "The Asset CleanUp: Page Speed Booster plugin for WordPress, in versions up to and including 1.4.0.5, contains a Server-Side Request Forgery (SSRF) vulnerability. This security flaw allows an authenticated administrator to force the web server to perform arbitrary HTTP requests to internal or external network resources. By manipulating the 'page_url' parameter when the 'dom_get_type' setting is specifically configured to 'wp_remote_post', an attacker can circumvent perimeter security controls to interact with internal services that are otherwise inaccessible from the public internet. This vulnerability poses a significant risk to organizational infrastructure, as it enables attackers to perform reconnaissance on internal network segments, potentially access sensitive metadata services, or interact with local services that lack authentication. The primary requirement for exploitation is administrative access to the WordPress dashboard and a specific, non-default configuration of the plugin's DOM retrieval method.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the Asset CleanUp: Page Speed Booster plugin, specifically in how it processes input passed via the 'page_url' parameter. When the plugin is configured to use 'wp_remote_post' for DOM retrieval—a setting accessible via the plugin's internal options—the application utilizes the WordPress 'wp_remote_post' function to fetch remote content. The flaw is caused by insufficient validation and sanitization of the 'page_url' parameter provided by the user.\nDuring normal operation, the plugin fetches pages to analyze or optimize CSS/JS delivery. An attacker with administrator privileges can inject a crafted URL into the 'page_url' field. Because the input is not adequately restricted to authorized domains or validated against an allowlist, the 'wp_remote_post' function acts as an unintentional proxy. When the plugin initiates the request, the web server acts as the initiator, effectively originating the request from within the trusted internal network environment.\nThe attack flow proceeds as follows: 1) The administrator navigates to the relevant plugin settings or utility page where the 'page_url' parameter is utilized. 2) The attacker submits a request containing a malicious 'page_url' value (e.g., an internal IP address such as http://127.0.0.1 or an internal network resource like http://169.254.169.254/latest/meta-data/). 3) The server-side code receives this input and passes it to the 'wp_remote_post' function without verification. 4) The server performs the request to the target destination. 5) The response from the target is then returned to the user or processed by the plugin, potentially leaking internal data or causing actions on internal services. This behavior bypasses network-level access controls, as the requests appear to originate from the server itself. The vulnerability is strictly limited to authenticated administrators, but given the nature of WordPress environments, this represents a significant privilege escalation vector if third-party administrative accounts are compromised."
}