Description

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-25T08:16:41.837Z",
  "pubdate": "2026-09-25T08:16:41.837Z",
  "executiveSummary": "The Optima Express IDX plugin for WordPress (versions 8.7.5 and below) contains a critical privilege escalation vulnerability.\nThe flaw allows unauthenticated remote attackers to gain the 'Author' role on affected WordPress installations by exploiting an improperly secured AJAX action.\nThis vulnerability stems from a lack of capability checks, nonce verification, and user ownership validation within the 'provisionBlogCredentials()' function.\nExploitation is contingent upon the WordPress site having open registration enabled and the attacker successfully registering the 'optima-express' username before the plugin performs its automated provisioning process.\nSuccessfully exploiting this vulnerability grants an attacker elevated capabilities including 'publish_posts', 'upload_files', and 'edit_published_posts', as well as unauthorized access to restricted REST API endpoints.\nThe exposure represents a high risk to the integrity and security of the WordPress instance, potentially allowing an attacker to execute arbitrary content creation and media uploads.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper implementation of the AJAX handler 'wp_ajax_nopriv_ihf_clear_cache' within the Optima Express IDX plugin.\nThe attack vector is initiated via an unauthenticated request to the WordPress AJAX endpoint, which triggers the 'iHomefinderAjaxHandler::clearCache()' method. This method serves as the entry point to a dangerous execution chain: 'clearCache()' -> 'activateAuthenticationToken()' -> 'getAuthenticationInfo()' -> 'provisionBlogCredentials()'.\nWithin 'iHomefinderAdmin.php', the 'provisionBlogCredentials()' function performs an unconditional modification of a user's privileges. It retrieves the user object associated with the login 'optima-express' using 'get_user_by('login', 'optima-express')'. Upon locating this user, the function executes '$user->set_role('author')'.\nThe fundamental security failure is the complete absence of input validation, capability checks (e.g., 'current_user_can()'), or cryptographic nonce verification within the AJAX handler or the downstream provisioning function. Consequently, any unauthenticated user can trigger the logic flow that elevates the privileges of the 'optima-express' account.\nTo exploit this, an attacker must leverage the 'Users > Registration' settings on a target WordPress site where 'Anyone can register' is enabled. The attacker registers a new account with the username 'optima-express'. Once registered, the attacker sends a crafted request to the plugin's AJAX handler. The server processes the request as if it were a legitimate administrative operation, promoting the attacker's account to the 'Author' role.\nPost-exploitation impact is severe, as the 'Author' role provides access to core WordPress functionality that should be restricted to authenticated, trusted users. This includes the ability to publish new posts, upload potentially malicious files, and edit existing posts. Furthermore, the attacker gains authenticated access to the plugin's internal REST API endpoints, specifically '/wp-json/optima-express/v1/blog-post', which can be utilized to further interact with or manipulate the plugin's internal state and data."
}