CVE-2026-96530: Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

Q: Which users can access the exposed account data?

Any authenticated WordPress user can access it, including users assigned the Subscriber role. The issue is caused by the dashboard widget exposing the data without a capability check.

Q: What information is disclosed?

The affected dashboard widget exposes stored account data for the site's image-optimization third-party service, including that service's credentials.

Q: Which plugin versions are affected?

Optimole versions 4.0.0 through 4.2.14 are affected. Version 4.2.15 is identified as the first version that is not affected.

Published Oct 7, 2026

Updated

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

Affected Software

1 affected component

Optimole Optimole WordPress plugin>=4.0.0<=4.2.14

Event History

Oct 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can access the exposed account data?

Any authenticated WordPress user can access it, including users assigned the Subscriber role. The issue is caused by the dashboard widget exposing the data without a capability check.

What information is disclosed?

The affected dashboard widget exposes stored account data for the site's image-optimization third-party service, including that service's credentials.

Which plugin versions are affected?

Optimole versions 4.0.0 through 4.2.14 are affected. Version 4.2.15 is identified as the first version that is not affected.

CVE-2026-96530: Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

Affected Software

Event History

Frequently Asked Questions

Which users can access the exposed account data?

What information is disclosed?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can access the exposed account data?

What information is disclosed?

Which plugin versions are affected?