OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-91828
PublishedThe OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-91828
PublishedOMGF < 6.3.11 - Unauthenticated DoS via do_optimize
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
- Source published
- 2 Oct 2026 06:00:25 UTC
- Source modified
- 2 Oct 2026 10:54:11 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.