CVE-2026-89190 PUBLISHED

Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

Assigner: WPScan
Reserved: 11.09.2026 Published: 30.09.2026 Updated: 30.09.2026

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.

Product Status

Vendor Unknown
Product Robin Image Optimizer
Versions Default: unaffected
  • affected from 0 to 2.0.8 (excl.)

Credits

  • Abdullah Kareem finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE