What is the CVSS score of CVE-2025-15693?

CVE-2025-15693 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15693?

Yes, a public proof-of-concept exploit is available for CVE-2025-15693. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2025-15693?

Yes, a patch is available for CVE-2025-15693. Update the affected software to the latest version immediately.

JCH Optimize CVE-2025-15693

EUVD-2025-210849 LOW

Path Traversal (CWE-22)

2026-09-05 WPScan

GHSA-pqwr-mv7c-mq9q

WordPress Path Traversal Jch Optimize Unknown

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.7 LOW

PR:H required (admin-only feature); C:L reflects filesystem name enumeration only, no content read; I:N and A:N as no modification or disruption is possible.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 06, 2026 - 13:31 vuln.today

CVSS changed

Sep 06, 2026 - 11:22 NVD

2.7 (LOW)

Patch available

Sep 05, 2026 - 08:01 EUVD

CVE Published

Sep 05, 2026 - 06:00 cve.org

LOW 2.7

CVE Published

Sep 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

AnalysisAI

Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - including sub-site administrators on WordPress multisite installations - to enumerate directories and file names outside the web root via an unsanitized path parameter in the plugin's administrative image-browsing feature. A public proof-of-concept is available through WPScan, though SSVC confirms no active exploitation and EPSS sits at the 5th percentile. Real-world impact is confined to confidentiality of filesystem structure: attackers can map server directory layouts and file names but cannot read file contents or modify data.

Technical ContextAI

JCH Optimize is a WordPress plugin designed for site performance optimization, including JavaScript, CSS, and image handling. Its administrative image-browsing component accepts a directory path parameter to locate media assets but fails to validate that the supplied path remains within the web root (CWE-22: Path Traversal / Improper Limitation of a Pathname to a Restricted Directory). This permits traversal sequences such as '../../' to escape the intended filesystem boundary. The CVSS vector (AV:N/PR:H) confirms the attack is delivered over the network by an authenticated high-privilege user. The CPE string cpe:2.3:a:unknown:jch_optimize:*:*:*:*:*:*:*:* contains an 'unknown' vendor placeholder; the actual vendor is JCH Technology. Affected versions span from 4.2.1 up to but not including 5.0.1.

RemediationAI

Update JCH Optimize to version 5.0.1 or later, which enforces path restriction in the administrative image-browsing feature to within the web root. The patch is available via the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/73e664a8-9075-4fe6-9af4-b6f5d2ccfe3c/. If immediate upgrade is not feasible, restrict the WordPress administrator role on multisite installations to trusted users only, as sub-site admins represent the higher-risk actor class for this flaw - they can traverse beyond their intended scope more meaningfully than full administrators. Auditing WordPress user role assignments and limiting sub-site admin provisioning reduces exposure without disabling plugin functionality.