CVE-2026-89190
Last modified
CVE-2026-89190 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings..
Description
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Robin Image Optimizer | < 2.0.8 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-89190?
How severe is CVE-2026-89190?
How do I fix CVE-2026-89190?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89179WeenyGenius, a computer lab management system by Howyar Tech…4.3
- CVE-2026-8918A permissive list of allowed inputs in ASUS Armoury Crate al…7.1
- CVE-2026-89180EFence developed by Thinking Software Technology has a SQL I…7.5
- CVE-2026-89182With `[repository] FORCE_PRIVATE = true`, Gitea creates new …5.4
- CVE-2026-89186Use of Cache Containing Sensitive Information in ZenHive mpp…6.3
- CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domai…7.2
- CVE-2026-89191Unsanitised input in the "template name" field of SQLView KR…6.8
- CVE-2026-89193The Robin Image Optimizer WordPress plugin before 2.0.8 doe…7.5
- CVE-2026-89195The Site Setup Wizard WordPress plugin through 1.5.8 does no…8.6
- CVE-2026-89196A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89197A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89198A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
Are you affected by CVE-2026-89190?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST