Optima Express
Monthly
Missing authorization in the iHomefinder Optima Express (MarketBoost IDX) WordPress plugin, affecting all versions through 9.0.0, lets remote attackers without credentials reach plugin functionality that should be access-controlled and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms a network-reachable, low-complexity, unauthenticated issue whose impact is confined to confidentiality, with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the specific plugin feature or endpoint that must be reachable is not described in the available sources, leaving an active installation of an affected version as the only firm precondition.
Missing authorization in the iHomefinder Optima Express (MarketBoost IDX) WordPress plugin, affecting all versions through 9.0.0, lets remote attackers without credentials reach plugin functionality that should be access-controlled and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) confirms a network-reachable, low-complexity, unauthenticated issue whose impact is confined to confidentiality, with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the specific plugin feature or endpoint that must be reachable is not described in the available sources, leaving an active installation of an affected version as the only firm precondition.