---
id: CVE-2026-111738
title: >-
  Speed Optimizer < 7.8.5 - Admin+ Network Option Update via
  enable-option/disable-option
summary: >-
  The Speed Optimizer  WordPress plugin before 7.8.5 does not verify
  network-level privilege before applying an option change to the whole
  multisite network, nor restrict which option may be changed, allowing a site
  administrator who is no…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L'
cvssSource: adp
cwe:
  - CWE-863
product: Speed Optimizer
affected:
  - speed_optimizer < 7.8.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T10:39:12.324101Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:46:04.518Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111738'
references:
  - url: 'https://wpscan.com/vulnerability/e08044dc-c514-4e4a-bf3e-995dd2ad29b1/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.172Z'
---

## Overview

The Speed Optimizer  WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.

## Affected

- `speed_optimizer < 7.8.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.