EUVD-2026-13995
GHSA-r2gp-fxxq-xp2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The speedup01_ajax_enabled() function, which handles the wp_ajax_speedup01_enabled AJAX action, does not perform any capability check via current_user_can() and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., speedup01_ajax_install_iox and speedup01_ajax_delete_cache_file) which properly check for install_plugins and manage_options capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site's optimization module by sending a POST request to admin-ajax.
AnalysisAI
The Speedup Optimization plugin for WordPress contains a missing authorization vulnerability in the speedup01_ajax_enabled() AJAX handler that fails to verify user capabilities or nonce tokens, allowing authenticated attackers with Subscriber-level privileges to enable or disable the site's optimization module. Affected versions include all releases up to and including 1.5.9, as documented by Wordfence. While the CVSS score of 5.3 is moderate, the vulnerability represents a clear authorization bypass that could allow low-privileged attackers to degrade site performance or disable security-relevant optimization features.
Technical ContextAI
The vulnerability resides in the WordPress AJAX handler infrastructure (wp_ajax_* hooks) within the Speedup Optimization plugin (CPE: cpe:2.3:a:charlycharm:speedup_optimization:*:*:*:*:*:*:*:*). The root cause is classified under CWE-862 (Missing Authorization), a common class of vulnerabilities where AJAX endpoints execute sensitive operations without verifying the requesting user's capabilities via WordPress's current_user_can() function or validating request authenticity via nonce verification. The affected function speedup01_ajax_enabled() is located at lines 172-178 in the plugin's main file, as confirmed by plugin repository source code inspection. Other AJAX handlers within the same plugin correctly implement capability checks (e.g., speedup01_ajax_install_iox checking for install_plugins capability), making this oversight particularly notable as a deviation from the plugin's own security practices.
RemediationAI
Site administrators should immediately update the Speedup Optimization plugin to the latest available version from the WordPress plugin repository at https://plugins.trac.wordpress.org/ or the official plugin page, once a patched version is released by charlycharm. Until a patch is available, administrators should restrict plugin usage by disabling the optimization module if not critical, or implement strict access control policies limiting Subscriber-level user creation to trusted individuals only. Network-level controls such as restricting admin-ajax.php access via Web Application Firewall rules (WAF) can temporarily mitigate exploitation, though this is not a substitute for the authoritative patch. Monitor WordPress user accounts and audit AJAX request logs for suspicious invocations of the speedup01_enabled action to detect potential exploitation attempts.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today