CVE-2026-96530: CWE-200 Information Exposure in Optimole

CVE-2026-96530 is an information exposure vulnerability (CWE-200) in the Optimole WordPress plugin versions 4.0.0 up to but not including 4.2.15. The plugin fails to verify user capabilities before displaying stored third-party service credentials in a dashboard widget. As a result, any authenticated user, regardless of privilege level, can read these sensitive credentials, potentially compromising the site's integration with the third-party image optimization service.

The vulnerability allows unauthorized disclosure of sensitive third-party service credentials to any authenticated user, including low-privilege roles such as Subscribers. This exposure could lead to misuse of the service account, unauthorized access to the image optimization service, or further compromise depending on the credentials' privileges. There is no indication of active exploitation in the wild.

Upgrade the Optimole plugin to version 4.2.15 or later where this issue is fixed. Since the vulnerability is due to missing capability checks, the official fix involves proper permission validation before displaying sensitive data. Patch status is not explicitly stated but the affected versions are prior to 4.2.15, indicating the fix is included in 4.2.15. Users should update promptly to remediate this exposure.