The JCH Optimize WordPress plugin fails to restrict the directory path given to its administrative image‑browsing function, allowing high‑privilege users to request arbitrary paths relative to the site root. This path‑traversal flaw lets such users enumerate directories and file names outside the web root, potentially exposing sensitive configuration files or other proprietary data. The weakness is a classic path‑traversal defect (CWE‑22).

WordPress installations using JCH Optimize versions 4.2.1 through 5.0.0 are affected. The flaw applies to single‑site administrators and sub‑site administrators in multisite environments, since any user with those roles can access the plugin’s administrative interface. The vulnerability exists wherever the plugin runs, regardless of hosting provider or environment.

The risk of exploitation is limited to authenticated, privileged users who can use the plugin’s admin interface; there is no documented path for unauthenticated attackers. It does not enable code execution or privilege escalation beyond information disclosure. The EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread targeted attacks. However, an attacker with administrative access could harvest sensitive files that might aid future attacks.