WordPress Plugin Vulnerabilities

Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

Description

The plugin does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only plugin pages and disclose the plugin's stored settings.

Proof of Concept

Affects Plugins

Plugin icon
robin-image-optimizer
Fixed in 2.0.8

References

CVE
CVE-2026-89190

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Submitter twitter
cyberkareem
Verified
Yes
WPVDB ID
570e6bfb-cfe9-4a6f-8759-c6e99e19e272

Timeline

Publicly Published
2026-09-28 (about 2 days ago)
Added
2026-09-28 (about 1 day ago)
Last Updated
2026-09-28 (about 1 day ago)

Other

Published
Title
Published
2022-07-26
Title
WPGraphQL WooCommerce < 0.12.4 - Unauthenticated Coupon Codes Disclosure
Published
2021-09-30
Title
JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation
Published
2021-04-22
Title
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Published
2023-10-16
Title
Templately < 2.2.6 - Unauthenticated Arbitrary Post Deletion
Published
2025-03-11
Title
Page Builder: Pagelayer – Drag and Drop website builder < 1.9.9 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode