WordPress Optima Express IDX Privilege Escalation via AJAX

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Optima Express IDX plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 8.7.5. The vulnerability exists in the `provisionBlogCredentials()` function, which is inadvertently exposed through an unauthenticated AJAX endpoint (`wp_ajax_nopriv_ihf_clear_cache`). By chaining multiple function calls—starting with `clearCache()` through `activateAuthenticationToken()` and `getAuthenticationInfo()`—an unauthenticated attacker can reach credential provisioning logic without any capability checks, nonce verification, or ownership validation. This allows attackers to escalate privileges and gain unauthorized administrative access to WordPress installations running vulnerable versions of the plugin. Given the widespread use of real estate plugins and the accessibility of AJAX endpoints, this vulnerability poses a significant risk to thousands of WordPress sites.

Casky's 224 mapped security skills leverage Claude's reasoning capabilities to detect the exploitation patterns behind this vulnerability by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify attack chains involving improper access control enforcement, missing authentication checks on WordPress hooks, and suspicious AJAX function execution flows. The platform would flag indicators such as: unauthenticated calls to privileged functions, missing `wp_verify_nonce()` validations, absent `current_user_can()` capability checks, and unusual credential provisioning activities without proper ownership verification. By correlating these patterns across your security telemetry, Casky helps teams detect exploitation attempts in real-time, spot plugin configurations that expose AJAX actions without authentication, and prioritize remediation of the privilege escalation pathway before attackers gain administrative access to sensitive WordPress environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93901.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-93901

Casky has 224 skills that investigate the attack patterns behind CVE-2026-93901. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn