CVE-2026-84934

JCH Optimize before 6.0.1 does not enforce a capability check on one of its authenticated AJAX actions and also lets the incoming request choose which internal action runs, so any logged-in user — including one with only the Subscriber role — can invoke it. By sending a crafted AJAX request, such a user can import arbitrary plugin settings, including a script that is stored in the site's configuration. The injected script then executes in the browser of any visitor or administrator who views the site (stored XSS, CWE-79), potentially compromising administrator sessions when admins view affected pages. All WordPress sites running the plugin prior to version 6.0.1 are affected, with the highest risk on sites that allow open user registration. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently puts the 30-day exploitation probability at 0.2% (percentile 13).

What to do: Update JCH Optimize to version 6.0.1 or later. Sites with open user registration should prioritize the update since any Subscriber-level account can trigger the flaw, and administrators should review the plugin's stored settings for unexpected scripts or unauthorized changes. No public PoC or in-the-wild exploitation is known, so this can be handled in normal patching cycles but should not be deferred.