Access Control Flaw in Robin Image Optimizer Plugin for WordPress
CVE-2026-89190

Currently unrated

Key Information:

Vendor

WordPress
Status
Robin Image Optimizer
Vendor
CVE Published:
30 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-89190?

The Robin Image Optimizer plugin for WordPress, prior to version 2.0.8, contains an access control vulnerability that allows subscribers to access admin-only pages. This flaw arises from inadequate checks on user capabilities, enabling unauthorized users to view sensitive settings stored within the plugin. Such unauthorized access can lead to disclosure of critical configuration data, making it essential for website administrators to upgrade to the latest version to mitigate the risk.

Affected Version(s)

Robin Image Optimizer 0 < 2.0.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-89190 - Proof of Concept

References

https://wpscan.com/vulnerability/570e6bfb-cfe9-4a6f-8759-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem
WPScan
.