Skip to content
Sign in
2.7 Low

CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its…

Description

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

Affected products and versions

Product Affected versions Fixed in
JCH Optimize 4.2 4.2.1 → < 5.0.1 5.0.1

Other CVEs of JCH Optimize

The 2 CVEs of JCH Optimize →
CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX… 8.0 High
Track this CVE