Exposed Account Data in Optimole WordPress Plugin
CVE-2026-96530
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-96530?
The Optimole plugin for WordPress prior to version 4.2.15 has a security flaw that allows authenticated users, including those with limited permissions such as Subscribers, to access sensitive account data stored within the plugin. This issue arises due to a lack of proper capability checks before displaying the data in a dashboard widget, potentially exposing third-party service credentials and leading to unauthorized access.
Affected Version(s)
Optimole 4.0.0 < 4.2.15
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.