EUVD-2026-87900

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

PT-2026-99505

Name of the Vulnerable Software and Affected Versions Optima Express IDX WordPress plugin versions prior to 8.7.6 Description An authorization check is missing in an AJAX action available to logged-out users. This allows unauthenticated attackers to force the creation of an account with a fixed...