Optima Express Idx
Monthly
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Stored cross-site scripting in the Optima Express IDX WordPress plugin before 8.7.6 allows an authenticated user with a role as low as author to inject a script value through one of the plugin's REST endpoints, which is persisted and then echoed unfiltered into the document head whenever the affected post is rendered. Exploitation requires a valid low-privileged WordPress account and completes only when a victim (for example an administrator or site visitor) loads the poisoned post in a browser, making it a stored, persistent injection rather than a reflected one. Publicly available exploit code exists and the issue is listed in WPScan with an advisory, but there is no confirmed active exploitation (CISA KEV absent, SSVC exploitation: none) and EPSS is low at 0.15% (4th percentile), so it should be treated as a genuine but modest-priority patch-now issue. A vendor fix is available in 8.7.6.
Unauthenticated remote attackers can force the creation of a fixed author-role WordPress account - and repeatedly rotate that account's application password - on any site running the Optima Express IDX plugin from 8.5.0 up to (but not including) 8.7.6, because one of its AJAX actions lacks any authorization check and is exposed to logged-out users. Exploitation requires no authentication (PR:N), no user interaction (UI:N), and low complexity; publicly available exploit code exists, though CISA's SSVC records no observed exploitation and EPSS is low at 0.14% (3rd percentile). Impact is bounded: the forged account is an author, not an administrator, so the flaw yields low-level integrity and confidentiality effects rather than full site takeover.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
Stored cross-site scripting in the Optima Express IDX WordPress plugin before 8.7.6 allows an authenticated user with a role as low as author to inject a script value through one of the plugin's REST endpoints, which is persisted and then echoed unfiltered into the document head whenever the affected post is rendered. Exploitation requires a valid low-privileged WordPress account and completes only when a victim (for example an administrator or site visitor) loads the poisoned post in a browser, making it a stored, persistent injection rather than a reflected one. Publicly available exploit code exists and the issue is listed in WPScan with an advisory, but there is no confirmed active exploitation (CISA KEV absent, SSVC exploitation: none) and EPSS is low at 0.15% (4th percentile), so it should be treated as a genuine but modest-priority patch-now issue. A vendor fix is available in 8.7.6.
Unauthenticated remote attackers can force the creation of a fixed author-role WordPress account - and repeatedly rotate that account's application password - on any site running the Optima Express IDX plugin from 8.5.0 up to (but not including) 8.7.6, because one of its AJAX actions lacks any authorization check and is exposed to logged-out users. Exploitation requires no authentication (PR:N), no user interaction (UI:N), and low complexity; publicly available exploit code exists, though CISA's SSVC records no observed exploitation and EPSS is low at 0.14% (3rd percentile). Impact is bounded: the forged account is an author, not an administrator, so the flaw yields low-level integrity and confidentiality effects rather than full site takeover.