JCH Optimize <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification
Strategic Overview
Vulnerability Overview
The JCH Optimize plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the doAjaxConfigureSettings(), doAjaxOptimizeImages(), doAjaxOnClickIcon(), and doAjaxSmartCombine() functions in versions up to, and including, 4.0.0. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify and control plugin settings. CVE-2024-30481 is likely a duplicate of this issue.
Technical Analysis
REMEDIATION: Update to version 4.0.1, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C