Unauthenticated Account Creation in Optima Express IDX WordPress Plugin

Executive Summary

This vulnerability affects the Optima Express IDX WordPress plugin versions 8.5.0 to 8.7.5. It allows unauthenticated attackers to exploit an AJAX action without proper authorization checks. This flaw enables the creation of an author-role account and repeated rotation of its application password on any connected installation.

Useful 0 Not Useful 0

Detection Guidance

Check if the Optima Express plugin version is below 8.7.6. Look for unauthorized author-role accounts or repeated password changes in WordPress user logs. Inspect AJAX requests to the vulnerable endpoint for unauthenticated access attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to your WordPress site by creating an author account and changing its password repeatedly. This could lead to unauthorized content changes, data theft, or further exploitation of your site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and potential data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access could result in data exposure, requiring breach notifications and potential fines.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Optima Express plugin to version 8.7.6 or later immediately. Remove any unauthorized author-role accounts created during exploitation. Review WordPress user logs for suspicious activity and reset passwords for all admin accounts.

Useful 0 Not Useful 0