Executive brief
JCH Optimize is a WordPress plugin that optimizes website performance. A flaw in the plugin allows any authenticated user, even with minimal permissions (Subscriber level), to inject malicious scripts into site settings. These scripts execute in the browsers of all visitors and administrators, enabling account compromise and site defacement.
Technical details
The plugin contains a missing capability check in an authenticated AJAX action (getcacheinfo) that allows the request to specify which internal task to execute. An attacker with Subscriber-level access can mint an admin-only nonce by accessing the settings screen endpoint, then use that nonce to import malicious plugin settings via the importsettings task. By injecting XSS payloads into the custom_css field, the attacker stores arbitrary JavaScript that executes in the browser of every site visitor and administrator. On systems where the plugin directory is web-writable, this can be further escalated to arbitrary PHP execution by uploading a malformed JSON file followed by PHP code. The vulnerability requires only basic authentication and no administrator action.
Affected products
- JCH Optimize before 6.0.1
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 6.0.1