CVE-2026-102375

Executive Summary

CVE-2026-102375 is a Broken Access Control vulnerability (CWE-862) in the Optimole WordPress plugin affecting versions 4.2.14 and earlier. An authenticated attacker holding low-privileged ("Subscriber"-level) credentials can exploit missing authorization checks to access functionality or data that should be restricted to higher-privileged users. Successful exploitation results in a high confidentiality impact, with no integrity or availability impact and no user interaction required.

Technical Analysis

The vulnerability is classified as Missing Authorization (CWE-862), described by the CNA as a "Subscriber Broken Access Control" issue in Optimole <= 4.2.14. In the WordPress context, a "Subscriber" is the lowest authenticated role, typically able to manage only their own profile. Broken Access Control at this level means one or more plugin endpoints or actions fail to verify that the requesting user holds a capability sufficient for the requested operation — for example, failing a current_user_can() capability check or missing a nonce/authorization gate before processing a request.

Per the available data, the concrete affected endpoint, REST route, AJAX action, parameter name, or function is not disclosed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the attack is network-reachable, requires low privileges, needs no user interaction, and is scoped to the vulnerable component. The high confidentiality (C:H) subscore with zero integrity (I:N) and availability (A:N) indicates the primary consequence is unauthorized read/access to data or resources rather than modification or denial of service.

Because the description provides only the vulnerability class and affected product/version, no specific implementation details (function names, file paths, API parameters, or routes) can be asserted. Any attempt to name such artifacts would be speculation and is therefore omitted.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred strictly from the vulnerability class (Broken Access Control / Missing Authorization) and the stated attacker privilege level.

1. Reconnaissance / target identification: An attacker identifies WordPress sites running the Optimole plugin at version 4.2.14 or earlier. This is typically done via plugin fingerprinting (e.g., enumerating /wp-content/plugins/optimole-wp/ assets, plugin readme/version disclosure, or passive scanning with dorks targeting the plugin directory) and by identifying sites that permit self-registration, since a Subscriber-level account is required.

2. Triggering the flaw class: With a valid low-privileged Subscriber account (self-registered if registration is open, or obtained via credential abuse), the attacker issues requests to plugin functionality that lacks a proper capability/authorization check. Because a protected operation does not enforce the required capability, the request succeeds for a Subscriber who should be denied.

3. Payload / execution at the vulnerability-class level: The attacker replays or crafts authenticated HTTP requests (e.g., to plugin REST or admin-ajax style entry points) that the plugin processes without validating the caller's authorization level. The specific request shape is unknown from the available data; exploitation relies on the missing access-control check rather than on a memory-corruption or injection primitive.

4. Post-exploitation impact: The attacker gains unauthorized read/access to data or resources exposed by the affected functionality, consistent with the high confidentiality impact (C:H). No data modification or service disruption is implied by the vector (I:N/A:N).

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Key subscores:

• Attack Vector: Network (AV:N) — remotely exploitable over the web.
• Attack Complexity: Low (AC:L) — no special conditions beyond valid low-privileged credentials.
• Privileges Required: Low (PR:L) — a Subscriber account suffices.
• User Interaction: None (UI:N) — no victim action needed.
• Scope: Unchanged (S:U) — impact confined to the vulnerable component.
• Confidentiality: High (C:H) — significant unauthorized data access.
• Integrity/Availability: None (I:N/A:N).

Blast radius: Any WordPress site running Optimole <= 4.2.14 that allows Subscriber-level registration (open registration, membership sites, WooCommerce/BuddyPress communities) is at elevated risk, since the low-privilege requirement is trivially met. Business impact centers on unauthorized disclosure of data exposed through the affected plugin functionality. EPSS has not yet been scored by FIRST.org; no CISA KEV listing applies; no in-the-wild exploitation is confirmed in the supplied data.

Detection Guidance

Sigma Rule

title: Optimole Plugin Broken Access Control - Low-Privilege Access Attempt
id: 6b1f0e2a-3c4d-4e5f-9a01-optimole2026
status: experimental
description: Detects requests to Optimole plugin endpoints originating from low-privileged (Subscriber) WordPress users, indicative of CVE-2026-102375 broken access control abuse.
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/plugins/optimole-wp/'
      - '/wp-json/optimole'
  selection_method:
    cs-method:
      - 'POST'
      - 'GET'
  filter_admins:
    cs-username|contains: 'admin'
  condition: selection_path and selection_method and not filter_admins
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate Subscriber-triggered plugin features if the plugin authorizes them
level: medium
tags:
  - attack.t1190
  - cve.2026.102375

YARA Rule

rule CVE_2026_102375_Optimole_BrokenAccessControl
{
    meta:
        description = "Detects Optimole plugin files advertising versions <= 4.2.14 potentially affected by CVE-2026-102375"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-102375"
        severity = "medium"

    strings:
        $plugin_slug = "optimole-wp" ascii wide nocase
        $ver = /Version:\s*4\.(2\.(1[0-4]|[0-9])|0\.[0-9]+|1\.[0-9]+)/ ascii

    condition:
        $plugin_slug and $ver
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102375 Optimole Broken Access Control - Low-Privilege Access"; flow:established,to_server; http.uri; content:"/wp-content/plugins/optimole-wp/"; nocase; http.method; content:"GET"; http.method; content:"POST"; classtype:attempted-recon; sid:2026102375; rev:1; metadata:affected_product Optimole, cve CVE_2026_102375, attack_target Web_Server;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where url.path : "/wp-content/plugins/optimole-wp/*" and http.request.method : ("GET", "POST")] by user.name
  [any where event.category : "authentication" and event.outcome : "success" and user.roles : "subscriber"] by user.name

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-content/plugins/optimole-wp/*" (method=GET OR method=POST)
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, method, status
| where count > 10
| table first_seen, last_seen, clientip, method, uri_path, status, count

Wazuh OSSEC Rule

<group name="web,appsec,optimole,">
  <rule id="100375" level="7">
    <if_sid>31100</if_sid>
    <match>/wp-content/plugins/optimole-wp/</match>
    <description>CVE-2026-102375: Access to Optimole plugin endpoint, potential broken access control by low-privileged user</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102375,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Disable or deactivate the Optimole plugin (<= 4.2.14) until a fixed release is available, if the plugin is non-critical to operations.
• Restrict user registration and review existing Subscriber accounts; remove or demote accounts that are not required.
• Enforce least privilege and audit Subscriber-level capabilities on affected sites.
• Add a WAF rule (virtual patch) filtering anomalous access to Optimole plugin endpoints.

2. Patch/upgrade steps:

• No vendor fix is identified at this time. Monitor the Optimole plugin vendor and the WordPress plugin repository for a fixed version greater than 4.2.14.
• Once available, upgrade Optimole beyond 4.2.14 and verify the deployed version.

3. Long-term hardening:

• Keep WordPress core, themes, and plugins updated and remove unused plugins.
• Harden role/capability assignments and enforce authorization checks at the application layer.
• Deploy monitoring for anomalous low-privilege access to plugin endpoints.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102375
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• WordPress plugin repository (Optimole): https://wordpress.org/plugins/optimole-wp/
• FIRST EPSS: https://www.first.org/epss/ (not yet scored)
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)

No threat actor campaigns or exploit-in-the-wild evidence are available in the supplied data.