CVE-2026-111738

MediumCVSS 5.5

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed. This allows a site administrator who is not a Super Admin to create or overwrite network-wide options.

Risk Assessment

A single-site administrator can modify the configuration of the entire multisite network, potentially affecting all subsites and weakening administrative control. This breaks privilege isolation in multisite.

Recommendation

Update the Speed Optimizer plugin to version 7.8.5 or later. Check whether network options were changed without authorization.

Other vulnerabilities in Speed Optimizer WordPress plugin

CVE-2026-111737Low
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages. This could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Original NVD description (English source)

The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS