Executive brief
JCH Optimize is a WordPress plugin that helps optimize website images and performance. A flaw in its administrative image-browsing tool allows site administrators to view directory and file names outside the website's root directory by manipulating directory paths, potentially exposing sensitive system information like configuration files or other non-public data.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the JCH Optimize plugin's filetree administrative AJAX action that fails to properly validate and restrict directory paths supplied by users. Authenticated attackers with administrator privileges (or sub-site administrator on WordPress multisite) can exploit this by sending specially crafted requests with relative path sequences (e.g., ../../../../../..) to the admin-ajax.php endpoint to enumerate directories and list files outside the WordPress installation root. The attack requires a valid WordPress nonce and administrator-level authentication. The vulnerability allows information disclosure only; no remote code execution or file write capability is present. The issue is fixed in version 5.0.1.
Affected products
- JCH JCH Optimize 4.2.1 to 5.0.0
Timeline
- 2026-09-03: disclosed
- 2025-09-05: patched: Fixed in version 5.0.1