What is the CVSS score of CVE-2026-4127?

CVE-2026-4127 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4127?

Organizations using for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-4127, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-4127?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Missing Authorization in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-4127

EUVD-2026-13995 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-r2gp-fxxq-xp2g

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13995

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The speedup01_ajax_enabled() function, which handles the wp_ajax_speedup01_enabled AJAX action, does not perform any capability check via current_user_can() and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., speedup01_ajax_install_iox and speedup01_ajax_delete_cache_file) which properly check for install_plugins and manage_options capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site's optimization module by sending a POST request to admin-ajax.

AnalysisAI

The Speedup Optimization plugin for WordPress contains a missing authorization vulnerability in the speedup01_ajax_enabled() AJAX handler that fails to verify user capabilities or nonce tokens, allowing authenticated attackers with Subscriber-level privileges to enable or disable the site's optimization module. Affected versions include all releases up to and including 1.5.9, as documented by Wordfence. While the CVSS score of 5.3 is moderate, the vulnerability represents a clear authorization bypass that could allow low-privileged attackers to degrade site performance or disable security-relevant optimization features.

Technical ContextAI

The vulnerability resides in the WordPress AJAX handler infrastructure (wp_ajax_* hooks) within the Speedup Optimization plugin (CPE: cpe:2.3:a:charlycharm:speedup_optimization:*:*:*:*:*:*:*:*). The root cause is classified under CWE-862 (Missing Authorization), a common class of vulnerabilities where AJAX endpoints execute sensitive operations without verifying the requesting user's capabilities via WordPress's current_user_can() function or validating request authenticity via nonce verification. The affected function speedup01_ajax_enabled() is located at lines 172-178 in the plugin's main file, as confirmed by plugin repository source code inspection. Other AJAX handlers within the same plugin correctly implement capability checks (e.g., speedup01_ajax_install_iox checking for install_plugins capability), making this oversight particularly notable as a deviation from the plugin's own security practices.

RemediationAI

Site administrators should immediately update the Speedup Optimization plugin to the latest available version from the WordPress plugin repository at https://plugins.trac.wordpress.org/ or the official plugin page, once a patched version is released by charlycharm. Until a patch is available, administrators should restrict plugin usage by disabling the optimization module if not critical, or implement strict access control policies limiting Subscriber-level user creation to trusted individuals only. Network-level controls such as restricting admin-ajax.php access via Web Application Firewall rules (WAF) can temporarily mitigate exploitation, though this is not a substitute for the authoritative patch. Monitor WordPress user accounts and audit AJAX request logs for suspicious invocations of the speedup01_enabled action to detect potential exploitation attempts.