EUVD-2026-94189
GHSA-q3p9-mmwf-qgrc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Any authenticated Subscriber can read credentials over the network without interaction, so PR:L/AV:N/AC:L/UI:N; disclosure-only yields C:H, I:N, A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
AnalysisAI
Optimole WordPress plugin versions 4.0.0 through 4.2.15 expose the site's stored third-party image-optimization service credentials to any authenticated user, including the lowest-privilege Subscriber role, because the account dashboard widget renders that data without a capability check. Exploitation requires only a valid account on the affected site and no user interaction, giving a complete confidentiality loss (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with the practical risk driven mostly by whether open self-registration lets an outsider obtain the required Subscriber session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session of any privilege level - including the lowest Subscriber role - on a WordPress site running Optimole between 4.0.0 and 4.2.15; no administrative rights, user interaction, or special configuration beyond having a plugin version that renders the credential-bearing dashboard widget is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue, best characterized as a legitimate medium-severity flaw rather than a high-urgency threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 4.2.15 - upgrade the Optimole plugin to 4.2.15 or later, which is the primary and complete fix, and consult the reporting advisory at https://wpscan.com/vulnerability/2153d029-a16d-4b8c-b232-6629a6abf34b/ for details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in the Optimole WordPress plugin versions 4.2.3 through 4.2.11 allows unauthenticated attack
Stored cross-site scripting in the Optimole WordPress plugin (versions 4.0.0 through 4.2.12) allows an authenticated use
Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows
Unauthenticated stored XSS in Optimole WordPress plugin (≤4.2.2) allows attackers to inject malicious scripts via the sr
Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.7.5. Rated
Stored/reflected Cross-Site Scripting in the Optimole WordPress image-optimization plugin (versions 4.2.7 and earlier) l
Exposure of restricted data in Optimole 4.2.14 and earlier lets authenticated WordPress Subscriber-level users read info
Reflected Cross-Site Scripting (XSS) in Optimole - Optimize Images in Real Time WordPress plugin versions up to 4.2.3 al
Cross-Site Request Forgery in the Optimole WordPress plugin (all versions through 4.2.6) allows unauthenticated remote a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today