Live › vulnerability › CVE-2026-111738
Go to dashboardThe Speed Optimizer WordPress plugin before 7.8.5 does not check network-level privilege before applying option changes across a multisite network. A site administrator who is not a Super Admin can create or overwrite network-wide options.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Speed Optimizer plugin before 7.8.5 on a WordPress multisite network are exposed. Single-site installs are not described as affected, and the exposure depends on having non-Super Admin site administrators on the network.
No product ranges from the sources yet.
wp plugin get speed-optimizer --field=versionwp core is-installed --networkwp super-admin list7.8.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
This page as .md · .json · in your agent: get_signal("CVE-2026-111738")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.