The vulnerability permits visitors to the WordPress site to exploit an unsecured AJAX action that is available to all users. By sending the dedicated request, an attacker can force the plugin to create a new author account with a fixed username and password, and thereafter trigger the same action to rotate the account’s application password repeatedly. This allows an attacker to establish a persistent, authenticated foothold on the WordPress site with sufficient privileges to perform many administrative tasks.

WordPress installations running the Optima Express IDX plugin versions 8.5.0 through 8.7.5 are affected. The plugin maintains its AJAX interface but does not guard the ihf_clear_cache action for unauthenticated users, creating a clear point of entry for attackers.

Based on the description, an attacker appears to be able to send a request to the plugin’s AJAX endpoint to create an author account and rotate its password, implying that no credentials are required. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.3 indicates moderate severity; however, the ability to create and maintain a privileged account represents a significant threat if exploitation occurs.