What the vulnerability does
01Description
The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()` function, which handles the `wp_ajax_speedup01_enabled` AJAX action, does not perform any capability check via `current_user_can()` and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., `speedup01_ajax_install_iox` and `speedup01_ajax_delete_cache_file`) which properly check for `install_plugins` and `manage_options` capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site's optimization module by sending a POST request to admin-ajax.
Explanation of Vulnerability in Simple Terms
02Summary
Speedup Optimization versions 1.5.9 and earlier lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter settings or content without proper permission validation. The vulnerability affects the integrity of site data but does not expose sensitive information or cause service disruption.
What an attacker can do
03Attacker Capabilities
Modify site data or settings without proper authorization as a low-privilege user.
Potential impact on your site
04Site Impact
Unauthorized changes to site configuration or content by low-privilege users; data integrity risk.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
March 21, 2026
CVE published
April 16, 2026
Record updated
