The Optima Express IDX plugin contains an unauthenticated AJAX action that can be invoked by anyone. The action triggers a chain of functions that eventually call provisionBlogCredentials(), which assigns the role 'author' to the user 'optima-express'. As a result, an attacker who creates or targets this login can elevate their privileges to Author, gaining capabilities to publish posts, upload files, and edit published posts, including access to the plugin's REST endpoint for blog posts. The weakness qualifies as improper authorization (CWE-269).

Affected are installations of the WordPress plugin Optima Express IDX from iHomefinder prior to and including version 8.7.5. All WordPress sites running any such version with open user registration enabled and an existing or pre-registered user named optima-express are potentially vulnerable.

The vulnerability is rated CVSS 7.3, indicating high severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. The exploit path requires only an unauthenticated HTTP request to the wp_ajax_nopriv_ihf_clear_cache endpoint and an existing or pre-registered user named optima-express, which can be achieved in most public WordPress sites that allow user registration. The ability to raise a pre‑registered account to Author provides significant impact on confidentiality, integrity, and availability for the site.