CVE-2026-93901 ihomefinder CVE debrief

Who should care

WordPress site administrators using the Optima Express IDX plugin, especially those with open user registration enabled, should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-93901 is a Privilege Escalation vulnerability in the Optima Express IDX plugin for WordPress. Defenders should prioritize patching, especially in environments with open user registration, as attackers can exploit this to gain Author role capabilities.

• Attackers can escalate privileges to Author role, gaining capabilities to publish posts, upload files, and edit published posts.
• Exploitation requires open user registration to be enabled on the target site.
• The attacker must register the `optima-express` username before the plugin provisions it for its integration account.
• Remediation priority is high due to the potential for unauthorized content publication and modification.

Technical summary

The Optima Express IDX plugin for WordPress has a Privilege Escalation vulnerability due to a missing capability check in the `provisionBlogCredentials()` function. This allows unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account. WordPress site administrators

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where open user registration is enabled.

Recommended defensive actions

• Patch the Optima Express IDX plugin to version greater than 8.7.5
• Disable open user registration on WordPress sites using the plugin
• Monitor for suspicious user registration and role changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by [email protected] and is detailed in the Wordfence threat intel report. The Optima Express IDX plugin for WordPress has a Privilege Escalation vulnerability due to a missing capability check in the `provisionBlogCredentials()` function. This allows unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.