Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Authenticated (Subscriber+) Sensitive Information Exposure via Dashboard Widget
- ID
- WPSEC-2026-0294
- Plugin
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (optimole-wp)
- Affected
- from 4.0.0 before 4.2.15
- Remediation
- Update to 4.2.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization on WPSec AttackSurface
- Fix released
- Published
Description
The Optimole plugin for WordPress is vulnerable to Sensitive Information Exposure via the admin dashboard widget in versions 4.0.0 up to, and including, 4.2.14. The cause is a missing capability check on the widget's registration and script loading, combined with the localization of the full stored service data into the dashboard page. That data includes the Optimole CDN key and secret, the account email address and, on sites registered through the plugin, the Optimole API key. This makes it possible for authenticated attackers with subscriber-level access and above to read these service credentials from the WordPress dashboard of a connected site.
References
- https://wpsec.com/vuln/WPSEC-2026-0294/
- https://plugins.svn.wordpress.org/optimole-wp/tags/4.2.15/
- https://wordpress.org/plugins/optimole-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS