CVE-2026-89190

MediumCVSS 4.3

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers. This allows users with a subscriber-level account to render admin-only plugin pages and disclose the plugin's stored settings.

Risk Assessment

Exposure of sensitive plugin settings to unauthorized users, potentially leading to unauthorized changes or further attacks.

Recommendation

Update the Robin Image Optimizer plugin to version 2.0.8 or later to enforce proper capability checks.

Other vulnerabilities in Robin Image Optimizer

CVE-2026-89193High
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Original NVD description (English source)

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS