CVE-2025-15693
JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
LOW 2.7EPSS 0.3%
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
- Affected
- JCH Optimize
- CVSS v3.1 CNA
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.26% chance of exploitation in the next 30 days, 17th percentile
- Published
- 2026-09-05
- Updated
- 2026-09-06