CVE-2025-15693— JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
Quick assessment
Affected
Unknown JCH Optimize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
版本低于 5.0.1 的 JCH Optimize WordPress 插件未对其管理后台的图片浏览功能中的目录路径进行适当的限制，使得该路径可能超出网站根目录。这使得高权限用户（单站点的管理员）以及多站点环境中的子站点管理员能够枚举 Web 根目录之外的目录和文件名。
Possible ATT&CK Techniques 3 AI
T1083 · File and Directory Discovery T1070 · Indicator Removal T1082 · System Information Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-15693
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | JCH Optimize | 4.2.1 ~ 5.0.1 | - |
|
II. Public POCs for CVE-2025-15693
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-15693
请登录查看更多情报信息。
Other References for CVE-2025-15693 (1)
-
https://wpscan.com/vulnerability/73e664a8-9075-4fe6-9af4-b6f5d2ccfe3c/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-05 · 34 CVEs total
| CVE-2026-78362 | SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Au | |
| CVE-2026-82846 | Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields | |
| CVE-2026-82304 | Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler | |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR | |
| CVE-2026-83543 | Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint | |
| CVE-2026-83544 | Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute | |
| CVE-2026-81423 | Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler | |
| CVE-2026-81348 | My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and | |
| CVE-2026-81404 | IPGP Visitors Origin < 1.6 - Reflected XSS | |
| CVE-2026-84021 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_ | |
| CVE-2026-77826 | RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Fa | |
| CVE-2026-78149 | Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_pas | |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure v | |
| CVE-2026-19861 | JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Em | |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deleti | |
| CVE-2026-19858 | JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure | |
| CVE-2025-15694 | Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS | |
| CVE-2026-84937 | YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax | |
| CVE-2026-84022 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attribu | |
| CVE-2026-84221 | Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: JCH Optimize
-
CVE-2026-84934
JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcachein -
CVE-2024-30481
WordPress JCH Optimize plugin <= 4.0.0 - Broken Access Contr -
CVE-2024-34808
WordPress JCH Optimize plugin <= 4.2.0 - Path Traversal vuln -
CVE-2023-25491
WordPress JCH Optimize Plugin <= 3.2.2 is vulnerable to Cros
Same vendor: Unknown
-
CVE-2026-84937
YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax -
CVE-2026-84927
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modif -
CVE-2026-84931
Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli -
CVE-2026-84930
CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via -
CVE-2026-84936
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews AP
V. Comments for CVE-2025-15693
No comments yet