CVE-2026-96897: Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Optima Express IDX WordPress pluginto a version that resolves this vulnerability.Fixed in 8.7.6
Event History
Frequently Asked Questions
Which installations are exposed?
Optima Express IDX versions before 8.7.6 are affected when the plugin is installed. The vulnerable AJAX action is available to logged-out users.
Does an attacker need a WordPress account or other authentication?
No. The issue can be exploited by an unauthenticated attacker because the affected AJAX action lacks an authorization check.
What access can exploitation provide?
An attacker can force creation of a fixed author-role account and repeatedly rotate that account's application password on a connected installation.
How can I determine whether an installation may have been affected?
Check whether the installed Optima Express IDX version is earlier than 8.7.6, and review WordPress accounts for the fixed author-role account described by the issue. Also review application-password activity associated with that account.