CVE-2026-96530: Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
Published Oct 7, 2026
·Updated
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
Affected Software
1 affected component
Optimole Optimole WordPress plugin>=4.0.0<=4.2.14
Event History
Oct 7, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can access the exposed account data?
Any authenticated WordPress user can access it, including users assigned the Subscriber role. The issue is caused by the dashboard widget exposing the data without a capability check.
2
What information is disclosed?
The affected dashboard widget exposes stored account data for the site's image-optimization third-party service, including that service's credentials.
3
Which plugin versions are affected?
Optimole versions 4.0.0 through 4.2.14 are affected. Version 4.2.15 is identified as the first version that is not affected.