CVE-2025-15693: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in JCH Optimize

The JCH Optimize WordPress plugin before version 5.0.1 contains a CWE-22 path traversal vulnerability. The flaw arises because the plugin does not properly restrict directory paths provided to an administrative image-browsing feature, enabling high-privilege users to enumerate directories and file names outside the web root. This affects version 4.2.1 explicitly. The CVSS 3.1 base score is 2.7, reflecting low impact with network attack vector, low complexity, high privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation level is indicated in the available data.

An attacker with high privileges (administrator or sub-site administrator) can enumerate directories and files outside the web root, potentially exposing sensitive file names or directory structures. There is no indication of code execution, integrity, or availability impact. The confidentiality impact is limited to information disclosure of file and directory names.

No official patch or remediation guidance is currently provided. Users should upgrade to JCH Optimize version 5.0.1 or later once available, as the vulnerability is fixed in versions after 4.2.1. Until then, restrict administrative access to trusted users only. Monitor vendor advisories for updates on patches or official fixes.