iHomefinder Optima Express EUVD-2026-112072

Exploitation requires only that a target WordPress site have the iHomefinder Optima Express (MarketBoost IDX) plugin installed and active at a version up to and including 9.0.0, and that the vulnerable endpoint be network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated as required. The description characterizes the flaw as 'Incorrectly Configured Access Control Security Levels', but the specific plugin feature, action, or setting that must be reachable is not described in the available sources, so the only firm limiting factor is the presence of the affected plugin version; impact is confined to confidentiality (C:H, I:N, A:N).

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with a CWE-862 Missing Authorization / broken access control issue that exposes data the attacker should not be able to read. The vuln.today decision label is 'this_week', suggesting meaningful but not emergency urgency. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no evidence of active exploitation or mass scanning at this time; the single reference is a Patchstack advisory rather than a weaponized exploit. The signals are therefore internally consistent but incomplete: the CVSS vector argues for easy remote exploitation, while the absence of EPSS/KEV/POC data means real-world exploitation pressure cannot be confirmed from the input. Treat this as a genuine confidentiality-exposure issue to patch promptly ('this_week'), but note the exact data exposed and the specific unprotected function are not described in the available sources - verify scope with the Patchstack/vendor advisory before assuming full data disclosure.

A remote, unauthenticated attacker sends a crafted request directly to a plugin endpoint or action in Optima Express (through 9.0.0) that fails to enforce an authorization check, and receives back data that should be access-restricted. No public exploit code was identified in the provided data, and the precise trigger is not described in the available sources. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required.