CVE-2026-116393: WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects iHomefinder Optima Express installations through version 9.0.0. The provided data does not identify a safe version or specify whether particular configurations are excluded.

Q: Can this be exploited remotely without an account?

Yes. The vector is network-based and the CVSS metrics indicate low attack complexity, no privileges required, and no user interaction required.

Q: What is the likely impact of successful exploitation?

The supplied CVSS vector rates confidentiality impact as high, while integrity and availability impacts are rated none. The issue is described as missing authorization caused by incorrectly configured access-control security levels.

Published Oct 28, 2026

Updated

Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0.

Affected Software

1 affected component

ihomefinder Optima Express + MarketBoost IDX Plugin<=9.0.0, <=8.7.8

Event History

Oct 28, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects iHomefinder Optima Express installations through version 9.0.0. The provided data does not identify a safe version or specify whether particular configurations are excluded.

Can this be exploited remotely without an account?

Yes. The vector is network-based and the CVSS metrics indicate low attack complexity, no privileges required, and no user interaction required.

What is the likely impact of successful exploitation?

The supplied CVSS vector rates confidentiality impact as high, while integrity and availability impacts are rated none. The issue is described as missing authorization caused by incorrectly configured access-control security levels.

CVE-2026-116393: WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the likely impact of successful exploitation?