CVE-2026-89190: Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Robin Image Optimizerto a version that resolves this vulnerability.Fixed in 2.0.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a WordPress account with at least subscriber-level access. The affected plugin fails to verify that user's capabilities before dispatching the relevant request handler.
What information can be exposed?
A subscriber-level user can render admin-only Robin Image Optimizer pages and disclose settings stored by the plugin.
Which plugin versions are affected?
Robin Image Optimizer versions before 2.0.8 are affected.