The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials() function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain iHomefinderAjaxHandler::clearCache() → activateAuthenticationToken() → getAuthenticationInfo() → provisionBlogCredentials() — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling $user->setrole('author') on whichever WordPress account matches the hard-coded login optima-express via getuserby('login', 'optima-express'). This makes it possible for unauthenticated attackers to escalate a pre-registered optima-express account to the Author role, gaining publishposts, uploadfiles, and editpublishedposts capabilities, including access to the plugin's own /wp-json/optima-express/v1/blog-post REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the optima-express username before the plugin has had the opportunity to provision that login for its own integration account.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 versions.