CVE-2026-93901
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Optima Express IDX plugin for WordPress (versions up to and including 8.7.5) is vulnerable to privilege escalation. The provisionBlogCredentials() function is reachable via the wp_ajax_nopriv_ihf_clear_cache AJAX action without capability checks, nonce verification, or ownership validation, and unconditionally sets the 'author' role for the account with login 'optima-express'. An unauthenticated attacker can register that username (if open registration is enabled) and gain author privileges.
Risk Assessment
An attacker can gain author-level capabilities, including publishing posts, uploading files, and editing published content, as well as access to the plugin's REST endpoint. This requires open user registration and prior registration of the 'optima-express' username.
Recommendation
Update the plugin to a version newer than 8.7.5 if available. If not, consider disabling open registration or restricting access to the AJAX action, and monitor for accounts with the login 'optima-express'.
Other vulnerabilities in Optima Express IDX
See all- CVE-2026-96899Low risk· EPSS 4%
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
- CVE-2026-96897Low risk· EPSS 3%
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
Original NVD description (English source)
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS