Robin Image Optimizer CVE-2026-89190

Requires a valid subscriber-level (authenticated, PR:L) account on the target WordPress site, so realistic exploitation depends on the site permitting open/self-service user registration; against sites with registration disabled the attacker must first obtain any low-privilege credential. Once authenticated, no user interaction or special server configuration is needed - the vulnerable code path is the plugin's bundled admin-framework request handler, which dispatches without a capability check in all deployments of Robin Image Optimizer before 2.0.8. Impact is limited to disclosure of the plugin's own stored settings (confidentiality only).

This is a low-real-risk broken-access-control issue despite being tagged an 'Authentication Bypass.' All signals align on low priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) reflects a network-reachable but authenticated (subscriber-level) flaw with only partial confidentiality impact and no integrity or availability impact. CISA SSVC corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial - which maps to a Track/defer decision, not Act. No EPSS score, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' The only asset at risk is disclosure of the plugin's own stored settings, not credentials or arbitrary site data, so even successful exploitation yields limited value. No signals conflict: every source (CVSS, SSVC, absence of KEV/POC) consistently points to a low-urgency, patch-in-normal-cycle issue. The main gating factor is that an attacker must already hold a valid subscriber account, limiting the useful attacker population to sites permitting open/self-service registration.

On a WordPress site running Robin Image Optimizer below 2.0.8 that allows open user registration, an attacker registers a low-privilege subscriber account and then sends a crafted request to the plugin's bundled admin-framework request handler, which dispatches without verifying the caller's capabilities. This renders admin-only plugin pages to the subscriber, disclosing the plugin's stored configuration settings. No public exploit code was identified at time of analysis.