WordPress Plugin Vulnerabilities
Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
Description
The plugin does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
Proof of Concept
Affects Plugins
References
CVE
Classification
Type
INCORRECT AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)