{"id":"CVE-2025-15693","title":"The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and…","summary":"The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-22"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15693","references":[{"url":"https://wpscan.com/vulnerability/73e664a8-9075-4fe6-9af4-b6f5d2ccfe3c/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00271,"epssPercentile":0.19721,"ingestedAt":"2026-09-06T02:48:40.911Z","slug":"CVE-2025-15693","body":"## Overview\n\nThe JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8159,"id":"CVE-2025-15693","ts":1788919965191,"field":"cvss","old":null,"new":"2.7"},{"seq":8158,"id":"CVE-2025-15693","ts":1788919965191,"field":"severity","old":"none","new":"low"},{"seq":7968,"id":"CVE-2025-15693","ts":1788919253250,"field":"cvss","old":"2.7","new":null},{"seq":7967,"id":"CVE-2025-15693","ts":1788919253250,"field":"severity","old":"low","new":"none"},{"seq":7777,"id":"CVE-2025-15693","ts":1788916325824,"field":"cvss","old":null,"new":"2.7"},{"seq":7776,"id":"CVE-2025-15693","ts":1788916325824,"field":"severity","old":"none","new":"low"},{"seq":7586,"id":"CVE-2025-15693","ts":1788915270901,"field":"cvss","old":"2.7","new":null},{"seq":7585,"id":"CVE-2025-15693","ts":1788915270901,"field":"severity","old":"low","new":"none"},{"seq":7395,"id":"CVE-2025-15693","ts":1788912685646,"field":"cvss","old":null,"new":"2.7"},{"seq":7394,"id":"CVE-2025-15693","ts":1788912685646,"field":"severity","old":"none","new":"low"},{"seq":7204,"id":"CVE-2025-15693","ts":1788911303216,"field":"cvss","old":"2.7","new":null},{"seq":7203,"id":"CVE-2025-15693","ts":1788911303216,"field":"severity","old":"low","new":"none"},{"seq":7011,"id":"CVE-2025-15693","ts":1788909054594,"field":"cvss","old":null,"new":"2.7"},{"seq":7010,"id":"CVE-2025-15693","ts":1788909054594,"field":"severity","old":"none","new":"low"},{"seq":6823,"id":"CVE-2025-15693","ts":1788907367524,"field":"cvss","old":"2.7","new":null},{"seq":6822,"id":"CVE-2025-15693","ts":1788907367524,"field":"severity","old":"low","new":"none"},{"seq":6631,"id":"CVE-2025-15693","ts":1788905422028,"field":"cvss","old":null,"new":"2.7"},{"seq":6630,"id":"CVE-2025-15693","ts":1788905422028,"field":"severity","old":"none","new":"low"},{"seq":6449,"id":"CVE-2025-15693","ts":1788903435978,"field":"cvss","old":"2.7","new":null},{"seq":6448,"id":"CVE-2025-15693","ts":1788903435978,"field":"severity","old":"low","new":"none"},{"seq":6245,"id":"CVE-2025-15693","ts":1788901790396,"field":"cvss","old":null,"new":"2.7"},{"seq":6244,"id":"CVE-2025-15693","ts":1788901790396,"field":"severity","old":"none","new":"low"},{"seq":6075,"id":"CVE-2025-15693","ts":1788899548738,"field":"cvss","old":"2.7","new":null},{"seq":6074,"id":"CVE-2025-15693","ts":1788899548738,"field":"severity","old":"low","new":"none"},{"seq":6007,"id":"CVE-2025-15693","ts":1788898240414,"field":"cvss","old":null,"new":"2.7"},{"seq":6006,"id":"CVE-2025-15693","ts":1788898240414,"field":"severity","old":"none","new":"low"}]}