CVE-2026-16042— LWS Optimize < 3.4 - Subscriber+ Cache Deletion
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | LWS Optimize | < 3.4 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16042
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LWS Optimize < 3.4 - Subscriber+ Cache Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Aurélien LWS LWS Optimize – All-in-One Speed Booster & Cache Tools 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Aurélien LWS LWS Optimize – All-in-One Speed Booster & Cache Tools是Aurélien LWS个人开发者的一款一站式性能优化方案。 Aurélien LWS LWS Optimize – All-in-One Speed Booster & Cache Tools 3.4之前版本存在授权问题漏洞，该漏洞源于未执行能力检查，可能导致任何已认证用户（包括订阅者）刷新站点缓存并强制重复重建缓存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | LWS Optimize | 0 ~ 3.4 | - |
II. Public POCs for CVE-2026-16042
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16042
请登录查看更多情报信息。
Other References for CVE-2026-16042 (1)
- 🔗 LWS Optimize < 3.4 – Subscriber+ Cache Deletion | CVE 2026-16042 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-02 · 27 CVEs total
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data | |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | |
| CVE-2026-14938 | FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR | |
| CVE-2026-15151 | Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rt | |
| CVE-2026-15206 | SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via | |
| CVE-2026-16256 | Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation | |
| CVE-2026-15248 | Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-15939 | Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API | |
| CVE-2026-15241 | ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_ge | |
| CVE-2026-15385 | RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS | |
| CVE-2026-12586 | Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset | |
| CVE-2026-15236 | Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure | |
| CVE-2026-11872 | Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save | |
| CVE-2026-16285 | WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download | |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR | |
| CVE-2026-16261 | Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover | |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | |
| CVE-2026-16292 | Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-16565
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modif - CVE-2026-16572
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' C - CVE-2026-16300
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Res - CVE-2026-16563
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content D - CVE-2026-16564
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification
V. Comments for CVE-2026-16042
No comments yet