CVE-2026-84934 Overview
CVE-2026-84934 affects the JCH Optimize WordPress plugin in versions prior to 6.0.1. The plugin exposes an authenticated AJAX action that lacks a capability check and allows the caller to select which internal action executes. Any authenticated user, including low-privileged Subscribers, can import arbitrary plugin settings and inject a stored script. The injected payload executes in the browser of any visitor or administrator who views the affected site.
Critical Impact
A Subscriber-level account can persist JavaScript on the WordPress site, enabling session theft, administrator account takeover, and full site compromise through stored cross-site scripting [CWE-79].
Affected Products
- JCH Optimize WordPress plugin versions before 6.0.1
- WordPress installations with the plugin installed and open user registration
- Multisite WordPress deployments running vulnerable plugin versions
Discovery Timeline
- 2026-09-05 - CVE-2026-84934 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84934
Vulnerability Analysis
The JCH Optimize plugin registers an authenticated AJAX endpoint that dispatches to internal handlers based on a user-supplied parameter. The endpoint does not enforce a current_user_can() capability check before executing the requested handler. This design permits any logged-in user to trigger administrator-only functionality, including the settings import routine.
The settings import handler accepts serialized plugin configuration and writes attacker-controlled values to persistent storage. Because certain configuration fields are rendered to page output without sanitization, an attacker can embed JavaScript that executes on every page load. The stored payload runs under the origin of the WordPress site and inherits the privileges of the viewing user.
When an administrator loads a page containing the injected script, the payload executes with administrator session context. This enables the attacker to create new administrator accounts, modify plugins, or install web shells through the WordPress admin interface.
Root Cause
Two defects combine to create the vulnerability. First, the AJAX action registered with wp_ajax_ hooks omits authorization enforcement and treats any authenticated request as trusted. Second, the router selects the internal action from request input, giving the caller control over which handler runs. The settings import path then stores unsanitized input that is later reflected into HTML output.
Attack Vector
An attacker registers a Subscriber account on any site that permits self-registration, or uses stolen low-privilege credentials. The attacker sends a crafted POST request to the WordPress AJAX endpoint, selecting the settings import handler and supplying a payload containing JavaScript. The plugin stores the payload in the WordPress options table. The script then executes for every visitor loading a page that renders the affected setting. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-84934
Indicators of Compromise
- Unexpected <script> tags or event handlers stored in JCH Optimize plugin settings within the wp_options table
- New WordPress administrator accounts created shortly after AJAX requests from Subscriber sessions
- POST requests to admin-ajax.php referencing JCH Optimize actions from users without the manage_options capability
Detection Strategies
- Review web server access logs for admin-ajax.php requests carrying JCH Optimize action names paired with low-privilege session cookies
- Compare current plugin settings against a known-good baseline to identify unauthorized configuration changes
- Audit rendered page HTML for injected script content originating from plugin-controlled output
Monitoring Recommendations
- Alert on creation of WordPress users with the administrator role outside change windows
- Track modifications to wp_options rows associated with the JCH Optimize plugin
- Monitor authentication events for Subscriber accounts issuing administrative AJAX calls
How to Mitigate CVE-2026-84934
Immediate Actions Required
- Update the JCH Optimize plugin to version 6.0.1 or later on all WordPress sites
- Audit the WordPress users table and remove any unrecognized administrator accounts
- Rotate credentials for all administrator accounts and invalidate active sessions
- Inspect plugin settings for injected script content and restore from a clean backup if tampering is confirmed
Patch Information
The vendor addressed the vulnerability in JCH Optimize version 6.0.1. The fix adds a capability check to the affected AJAX action and restricts the set of internal actions callable from that entry point. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable open user registration by unchecking Anyone can register under WordPress General Settings
- Deactivate the JCH Optimize plugin until the patched version is installed
- Restrict access to admin-ajax.php for unauthenticated and low-privilege users using a web application firewall rule
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
