PT-2026-26877 · WordPress · Speedup Optimization

Nabil Irawan · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4127

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Speedup Optimization plugin for WordPress versions up to and including 1.5.9

Description The Speedup Optimization plugin for WordPress is affected by a missing authorization issue. The speedup01 ajax enabled() function, responsible for handling the wp ajax speedup01 enabled AJAX action, does not verify user capabilities using current user can() or implement nonce verification. This allows authenticated attackers with Subscriber-level access or higher to enable or disable the site’s optimization module by sending a POST request to the ''/admin-ajax'' endpoint. The speedup01 ajax enabled() function is the vulnerable component.

Recommendations Versions prior to 1.5.9 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4127

Affected Products

Speedup Optimization

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4127 · Security Note
• https://plugins.trac.wordpress.org/browser/speedup-optimization/trunk/speedup-optimization.php#L172 · Note
• https://plugins.trac.wordpress.org/browser/speedup-optimization/trunk/speedup-optimization.php#L178 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3f37c650-af0d-4474-9c1b-7f8d361b4d81?source=cve · Note
• https://twitter.com/CVEnew/status/2035237293452394721 · Twitter Post
• https://plugins.trac.wordpress.org/browser/speedup-optimization/tags/1.5.9/speedup-optimization.php#L178 · Note
• https://twitter.com/VulmonFeeds/status/2035248553887412563 · Twitter Post
• https://plugins.trac.wordpress.org/browser/speedup-optimization/tags/1.5.9/speedup-optimization.php#L172 · Note