low2.7
CVE-2025-15693
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to wit…
Impact
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Affected products
| Product | Affected versions |
|---|---|
| JCH Optimize WordPress Plugin | before 5.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.