CVE-2025-15693
Received Received - Intake

JCH Optimize WordPress Plugin Directory Traversal Vulnerability

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2025-15693
EUVD
EUVD-2025-210849

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jch_optimization jch_optimize From 4.2.1 (inc) to 5.0.0 (inc)
jch_optimization jch_optimize to 5.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-15693 is a Path Traversal vulnerability in the JCH Optimize WordPress plugin versions 4.2.1 through 5.0.0. It occurs because the plugin does not properly restrict directory paths in an administrative image-browsing feature. This allows high-privilege users, including administrators on single-site and sub-site administrators on multisite setups, to access and enumerate directories and file names outside the web root.

Detection Guidance

Check the installed version of the JCH Optimize plugin. If it is between 4.2.1 and 5.0.0, the system is vulnerable. Log in as a high-privilege user and attempt to access restricted directories via the plugin's image-browsing feature.

Impact Analysis

This vulnerability allows attackers with high privileges to view directory structures and file names outside the intended web root. This could expose sensitive files, configuration details, or other confidential information, potentially leading to further exploitation or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Exposure of personal or health information could result in legal penalties, fines, or reputational damage for organizations.

Mitigation Strategies

Update the JCH Optimize plugin to version 5.0.1 or later immediately. If updating is not possible, consider disabling the plugin until the update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart