CVE-2026-84934

HighCVSS 8.0

Published: 05/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The JCH Optimize WordPress plugin before version 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.

Risk Assessment

Risk includes takeover of plugin configuration, injection of malicious script, potentially leading to data theft and administrator compromise.

Recommendation

Update the plugin to version 6.0.1 or later. Restrict user permissions and monitor AJAX activity.

Other vulnerabilities in JCH Optimize

CVE-2025-15693Low
The JCH Optimize WordPress plugin before version 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site. This allows high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

Original NVD description (English source)

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS