CVE-2026-89190

MEDIUMCVSS 4.3

Description

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.

Timeline

Published:September 30th, 2026 6:17 AM

Last modified:September 30th, 2026 4:28 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-284

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/570e6bfb-cfe9-4a6f-8759-c6e99e19e272/

Source: NIST NVD · Data may lag official sources by up to one minute