CVE-2026-93901 is a privilege escalation vulnerability in the Optima Express IDX plugin for WordPress (versions <= 8.7.5). The vulnerability arises because the 'provisionBlogCredentials()' function in 'iHomefinderAdmin.php' can be triggered via the 'wp_ajax_nopriv_ihf_clear_cache' AJAX action without any capability checks, nonce verification, or ownership validation. This function unconditionally sets the WordPress user with login 'optima-express' to the Author role. An unauthenticated attacker can exploit this by registering the 'optima-express' username (if open registration is enabled) before the plugin provisions it, thereby gaining elevated privileges including access to the plugin's REST endpoint.

An attacker can escalate privileges of a WordPress user account named 'optima-express' to the Author role, granting the ability to publish posts, upload files, and edit published posts. This can lead to unauthorized content publication and potential further compromise via the plugin's REST API. The attack requires open user registration and pre-registration of the 'optima-express' username by the attacker.

No official patch or fix is currently documented. Users should verify if a vendor advisory or update is available. Until then, mitigation includes disabling open user registration on the WordPress site to prevent attacker registration of the 'optima-express' username. Monitor for updates from the vendor and apply official patches once released.