CVE-2025-15693 – JCH Optimize – Path Traversal via the filetree dir Parameter – PoC

JCH Optimize is a well-known WordPress performance plugin (page-cache, CSS/JS minification and image optimization) running on about 4,000 active sites. During security testing a Path Traversal flaw was found and assigned CVE-2025-15693: one of the plugin’s administrative file-browsing AJAX endpoints does not restrict the supplied directory path to the site, so a high-privilege user can walk out of the WordPress installation with ../../.. sequences and enumerate folders and file names outside the web root, such as /etc/ or /var/. The issue affects versions 4.2.1 – 5.0.0 and is fixed in 5.0.1.

CVE	CVE-2025-15693
	JCH Optimize 4.2.1 – 5.0.0
All Time	356 778
Active installations	4 000+
Publicly Published	September 3, 2026
Last Updated	September 3, 2026
Researcher	Krugov Artyom
OWASP TOP-10	A01:2021 – Broken Access Control (Path Traversal)
CWE	CWE-22
PoC	Yes
Exploit	No
Reference	https://www.cve.org/CVERecord?id=CVE-2025-15693 https://wpscan.com/vulnerability/73e664a8-9075-4fe6-9af4-b6f5d2ccfe3c/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

September 15, 2025	Plugin testing and vulnerability detection in the JCH Optimize have been completed
September 15, 2025	I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing
September 3, 2026	Registered CVE-2025-15693

Discovery of the Vulnerability

While auditing the AJAX handlers of the JCH Optimize plugin, I found that its filetree file-browser action reads a directory path from the dir request parameter and lists that directory back to the caller without validating that the path stays inside the plugin’s or the site’s allowed base directory. The endpoint is reached at /wp-admin/admin-ajax.php?action=filetree and only requires a valid _wpnonce. Because the dir value is used to build the filesystem path directly, supplying ../../.. resolves above the WordPress root, and the handler returns the listing of whatever directory it lands in — a classic Path Traversal (directory traversal) weakness.

Understanding of Path Traversal attacks

Path Traversal (also called directory traversal) happens when an application builds a filesystem path from user input without normalizing and constraining it to an intended base directory. Relative sequences like ../ let the attacker step up the directory tree and reach files or folders the application never meant to expose. Even when the endpoint only lists directories rather than reading file contents, the leaked structure — usernames under /home/, service layouts under /etc/ and /var/, backup and configuration file names — is valuable reconnaissance for a follow-up attack. This case requires a high-privilege account, which keeps the CVSS Low, but it is more relevant on WordPress Multisite, where sub-site administrators are not meant to reach the underlying server filesystem at all.

Exploiting the Path Traversal Vulnerability

To reproduce the vulnerability on an affected version (4.2.1 – 5.0.0):

• Log in as an Administrator (or a sub-site administrator on Multisite) to obtain a valid _wpnonce for the plugin’s file-browser action.
• Send a request to the filetree AJAX endpoint with a traversal sequence in the dir parameter.
• Observe that the response contains directory listings from outside the WordPress installation, e.g. /etc/, /var/ or other system paths.

PoC request:

GET /wp-admin/admin-ajax.php?action=filetree&_wpnonce=<valid_nonce>&dir=../../.. HTTP/1.1

Instead of returning only the paths intended for the optimizer, the server responds with the contents of the directory reached by the traversal. By increasing the number of ../ segments and changing the target, an attacker can map the host’s directory structure outside the web root and use that information to plan further attacks.

Recommendations for Improved Security

To mitigate CVE-2025-15693:

• Update JCH Optimize to version 5.0.1 or later immediately.
• Canonicalize the supplied path with realpath() and reject it unless it stays within an explicit allowed base directory.
• Strip traversal sequences and reduce the input to a safe segment with basename() / wp_normalize_path() before using it.
• Enforce capability checks (current_user_can()) and a verified nonce on every administrative AJAX action.
• Run PHP with an open_basedir restriction so the web process cannot read outside the site directory even if a path check is missed.
• Deploy a Web Application Firewall to block traversal patterns (../, encoded variants) in request parameters.

To prevent this type of attack, follow our web-application security guidance.

By addressing Path Traversal vulnerabilities like CVE-2025-15693 early, WordPress site owners and plugin developers keep the underlying server filesystem out of reach. Stay vigilant, stay secure.

#WordPressSecurity #PathTraversal #JCHOptimize #WebsiteSafety #StayProtected

Use CleanTalk solutions to improve the security of your website

Krugov Artyom