WordPress Plugin Vulnerabilities

Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option

Description

The plugin does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.

Proof of Concept

Affects Plugins

Fixed in 7.8.5

References

Classification

Type
INCORRECT AUTHORISATION
CWE

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes

Timeline

Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)

Other