CyberRota Analysis
AI-GeneratedThe JCH Optimize WordPress plugin prior to version 6.0.1 is vulnerable due to a lack of capability checks on authenticated AJAX actions, allowing any authenticated user, including Subscribers, to import arbitrary settings. This could lead to the execution of malicious scripts in the browsers of site visitors or administrators, posing a significant security risk. WordPress site administrators using this plugin should prioritize updating to version 6.0.1 or later to mitigate this vulnerability.
Original NVD Description
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.