CVE-2026-93901— Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
Quick assessment
Affected
ihomefinder Optima Express IDX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Optima Express IDX 插件在所有包含 8.7.5 在内的版本中均存在权限提升漏洞。该漏洞源于 文件中的 函数可通过 AJAX 操作触发。其调用链为： → → → ，且该过程中未进行任何能力权限检查、nonce 验证或所有权校验。此外，该函数会无条件地通过 查找与硬编码登录名 匹配的 WordPress 用户，并直接将其角色设置为 。 这使得未认证的攻击者可以将预先注册的 账户提升为作者（Author）角色，从而获得发布文章（publish_posts）、上传文件（upload
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93901
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
Source: CVE Program / CVE List V5
Vulnerability Description
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ihomefinder | Optima Express IDX | 0 ~ 8.7.5 | - |
|
II. Public POCs for CVE-2026-93901
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93901
请登录查看更多情报信息。
Other References for CVE-2026-93901 (1)
Other References for CVE-2026-93901 (9)
IV. Related Vulnerabilities
Same weakness: CWE-269
-
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass -
CVE-2026-77203
Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Esca -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100620
Capgo CLI through 7.98.2 Excessive Permissions via Overpermi -
CVE-2026-100615
Cap-go capgo.app before 12.267.1 Privilege Escalation via AP
V. Comments for CVE-2026-93901
No comments yet