Speed Optimizer CVE-2026-111738

Exploitation requires a WordPress multisite network deployment running Speed Optimizer before 7.8.5, plus an attacker who already holds a site-administrator account on a subsite but is not a Super Admin (PR:H). The core limiting factor is the multisite architecture: on standard single-site WordPress there is no Super Admin / network-option distinction, so the flaw does not apply. No end-user interaction is required (UI:N) and no non-default plugin setting is cited in the sources, but the attacker must be an authenticated high-privilege insider, which bounds realistic risk to trusted or compromised subsite admins rather than anonymous attackers.

This is a medium-severity, authenticated privilege-escalation / broken-authorization issue (CWE-863), not an internet-facing mass-exploitation threat. The supplied CVSS vector (AV:N/AC:L/PR:H/UI:N, score 5.5) requires PR:H - a WordPress site administrator account - so the attacker must already be a trusted high-privilege user on a subsite; this maps to an insider or compromised-subsite-admin scenario rather than anonymous remote attack. The signals are internally consistent and all point to lower urgency: SSVC shows Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing (not actively exploited) and no public exploit identified; EPSS was not provided in the input so exploitation-probability cannot be quantified. The vendor priority label is 'this_month' (not act_now/emergency), aligning with the SSVC framing. Impact is integrity-focused (I:H, overwrite of network-wide options) with no confidentiality loss and only partial availability impact. Net: a legitimate but non-emergency fix - schedule patching this month; the primary risk is a non-Super-Admin site administrator escalating control over an entire multisite network.

On a WordPress multisite, a user who holds only site-administrator (not Super Admin) rights on one subsite uses the Speed Optimizer option-saving functionality to write or overwrite arbitrary network-wide options, effectively escalating their authority over the whole network. The exact HTTP/function trigger is not described in the available sources. No public exploit was identified at time of analysis; the attacker must already possess a high-privilege admin account (PR:H).