CVE-2026-93901: Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials() function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain iHomefinderAjaxHandler::clearCache() → activateAuthenticationToken() → getAuthenticationInfo() → provisionBlogCredentials() — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling $user->setrole('author') on whichever WordPress account matches the hard-coded login optima-express via getuserby('login', 'optima-express'). This makes it possible for unauthenticated attackers to escalate a pre-registered optima-express account to the Author role, gaining publishposts, uploadfiles, and editpublishedposts capabilities, including access to the plugin's own /wp-json/optima-express/v1/blog-post REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the optima-express username before the plugin has had the opportunity to provision that login for its own integration account.
Affected Software
Event History
Frequently Asked Questions
Which sites are realistically exposed to exploitation?
Exposure requires open WordPress user registration and an affected Optima Express IDX version up to and including 8.7.5. The attacker must also be able to register the optima-express username before the plugin provisions that account.
Does an attacker need to log in or trick a user to exploit this?
No. The affected AJAX action is reachable without authentication, and the described path has no capability check, nonce verification, or ownership validation.
What access does successful exploitation provide?
The attacker-controlled optima-express account is assigned the WordPress Author role. This grants publish_posts, upload_files, and edit_published_posts capabilities, and includes access to the plugin's /wp-json/optima-express/v1/blog-post REST endpoint.
What can be checked to identify possible exposure or compromise?
Check whether open user registration is enabled and whether a WordPress account named optima-express exists, particularly if the plugin is version 8.7.5 or earlier. Review that account's assigned role and its post, upload, and REST endpoint activity.