The vulnerability permits anyone on the network to exploit an unsecured AJAX action that is available to all visitors. By sending the dedicated request, an attacker can force the plugin to create a new author account with a fixed username and password, and thereafter trigger the same action to rotate the account’s application password repeatedly. This allows an attacker to establish a persistent, authenticated foothold on the WordPress site with sufficient privileges to perform many administrative tasks.

WordPress installations running the Optima Express IDX plugin versions 8.5.0 through 8.7.5 are affected. The plugin maintains its AJAX interface but does not guard the ihf_clear_cache action for unauthenticated users, creating a clear point of entry for attackers.

The exploit requires no credentials and is achieved via a simple HTTP request to the plugin’s AJAX endpoint, making it highly actionable. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but the impact is significant because the attacker can create and maintain an account with author privileges. The CVSS score is not provided, yet the combination of an unauthenticated vector, the critical administrative privileges granted, and the ability to persist through password rotation indicates a high‑severity risk.