LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'
high
The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary fi...
- CVSS:
- 7.2
- Affected:
- up to 2.4.1.3
- Fixed in:
- 2.4.2
- Disclosed:
- Sep 11, 2025
CVE-2025-8575 on NVD →
LWS Cleaner <= 2.3.0 - Cross-Site Request Forgery
medium
The LWS Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administ...
- CVSS:
- 5.4
- Affected:
- up to 2.3.0
- Fixed in:
- 2.3.1
- Disclosed:
- Jun 16, 2023
CVE-2023-35781 on NVD →
LWS Plugins <= (Various Versions) - Missing Authorization Checks
high
Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...
- CVSS:
- 8.8
- Affected:
- up to 2.0.3
- Fixed in:
- 2.1
- Disclosed:
- Dec 12, 2022
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database