The vulnerability exists because the Robin Image Optimizer plugin does not verify the user’s capabilities before executing certain AJAX handlers bundled with its admin framework. As a result, any user with a subscriber‑level role can trigger these handlers. This allows the subscriber to load admin‑only pages of the plugin and reveal settings that are normally restricted to administrators. The primary impact is the disclosure of sensitive plugin configuration data, which could be leveraged for further attacks. The weakness corresponds to improper access control (CWE‑284).

WordPress sites that have the Robin Image Optimizer plugin installed at a version earlier than 2.0.8 are vulnerable. The plugin versions 1.x up to 2.0.7 lack the capability check. No specific PHP or WordPress version is required beyond the plugin’s presence, as the issue resides entirely in the plugin’s code.

The CVSS score of 4.3 indicates a medium impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw enables privileged information disclosure through a web‑based AJAX endpoint, an attacker only needs a valid subscriber account on the affected site. The attack requires no special software or network access beyond normal web interaction. While no public exploit is reported yet, the straightforward nature of the flaw gives it a moderate risk level for sites that rely on subscriber accounts to stay unaware of administrative data.