Skip to content
Sign in
6.5 Medium

CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored…

Description

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

Affected products and versions

Product Affected versions Fixed in
Optimole 4.0 4.0.0 → < 4.2.15 4.2.15

Other CVEs of Optimole

The 3 CVEs of Optimole →
CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before… 6.8 Medium CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build… 8.8 High
Track this CVE