WordPress Plugin Vulnerabilities

OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

Description

The plugin does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

Proof of Concept

Affects Plugins

Plugin icon
host-webfonts-local
Fixed in 6.3.11

References

CVE
CVE-2026-91828

Miscellaneous

Original Researcher
Ángel Santana
Submitter
Ángel Santana
Verified
Yes
WPVDB ID
be25f7b5-5790-4db7-9056-b43b538a7183

Timeline

Publicly Published
2026-09-29 (about 2 days ago)
Added
2026-09-29 (about 2 days ago)
Last Updated
2026-09-29 (about 2 days ago)

Other

Published
Title
Published
2025-10-29
Title
Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue < 1.48 - Unauthenticated Log File Poisoning
Published
2016-06-21
Title
WordPress 4.5.2 - oEmbed Denial of Service (DoS)
Published
2024-12-12
Title
Minify HTML < 2.1.11 - - Regular Expressions Denial of Service
Published
2014-11-20
Title
WordPress <= 4.0 - Long Password Denial of Service (DoS)
Published
2026-09-14
Title
Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update