{"id":"CVE-2026-111738","kind":"vulnerability","aliases":["CVE-2026-111738"],"related":[],"title":"Speed Optimizer WordPress plugin lets site admins change network-wide options","description":"The Speed Optimizer  WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.","summary":"The Speed Optimizer WordPress plugin before 7.8.5 does not check network-level privilege before applying option changes across a multisite network. A site administrator who is not a Super Admin can create or overwrite network-wide options.","severity":"medium","cvss":5.5,"epss":0.00132,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","speed-optimizer","wordpress","wordpress-multisite"],"not_affected_if":["no-multisite","plugin-version-7.8.5-or-later","single-site-install"],"how_to_check":"- Check the installed Speed Optimizer version in the WordPress admin plugin list or with `wp plugin get speed-optimizer --field=version`\n- Check whether the site runs WordPress multisite with `wp core is-installed --network`\n- Check the list of Super Admins with `wp super-admin list`","fix":"- Update Speed Optimizer to `7.8.5` or later\n- Review network options changed by non-Super Admin accounts if the plugin was vulnerable","status":"open","published_at":"2026-10-23T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:10:39+00:00","updated_at":"2026-10-25T04:10:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update Speed Optimizer to `7.8.5` or later\n- Review network options changed by non-Super Admin accounts if the plugin was vulnerable","reach":"network","title":"Speed Optimizer WordPress plugin lets site admins change network-wide options","impact":"medium","summary":"The Speed Optimizer WordPress plugin before 7.8.5 does not check network-level privilege before applying option changes across a multisite network. A site administrator who is not a Super Admin can create or overwrite network-wide options.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-multisite","speed-optimizer"],"confidence":0.6,"needs_auth":"yes","worst_case":"Site admin overwrites network-wide WordPress options","analyst_note":"","how_to_check":"- Check the installed Speed Optimizer version in the WordPress admin plugin list or with `wp plugin get speed-optimizer --field=version`\n- Check whether the site runs WordPress multisite with `wp core is-installed --network`\n- Check the list of Super Admins with `wp super-admin list`","needs_analyst":false,"not_affected_if":["single-site-install","plugin-version-7.8.5-or-later","no-multisite"],"who_is_affected":"Sites running the Speed Optimizer plugin before 7.8.5 on a WordPress multisite network are exposed. Single-site installs are not described as affected, and the exposure depends on having non-Super Admin site administrators on the network.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3352,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111738':15A,18A '-2026':14A,17A '7.8.5':33B,72C 'across':45B 'admin':7A,57B,106C 'administr':51B,100C 'allow':97C 'appli':42B,81C 'chang':8A,44B,84C,96C 'check':36B 'creat':59B,108C 'cve':13A,16A 'let':5A 'level':39B,78C 'may':94C 'multisit':26B,47B,88C 'network':10A,38B,48B,63B,77C,89C,112C 'network-level':37B,76C 'network-wid':9A,62B,111C 'optim':2A,22B,29B,68C 'option':12A,43B,65B,83C,93C,114C 'overwrit':61B,110C 'packag':19B 'plugin':4A,31B,70C 'privileg':40B,79C 'restrict':91C 'site':6A,50B,99C 'speed':1A,21B,28B,67C 'speed-optim':20B 'super':56B,105C 'verifi':75C 'whole':87C 'wide':11A,64B,113C 'wordpress':3A,23B,25B,30B,69C 'wordpress-multisit':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Speed Optimizer plugin before 7.8.5 on a WordPress multisite network are exposed. Single-site installs are not described as affected, and the exposure depends on having non-Super Admin site administrators on the network.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111738","severity":null,"published_at":"2026-10-23T06:17:05+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111738","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111738","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}