Speed Optimizer plugins before version 7.8.5 allow site administrators who are not Super Administrators to use the enable‑option or disable‑option actions to create or overwrite entire multisite network options without proper privilege verification. The privilege escalation flaw enables an attacker to modify configuration across all sites in a multisite network, potentially toggling features, tampering with settings, or disrupting network‑wide functionality.

Any WordPress installation that employs the Speed Optimizer plugin in a version earlier than 7.8.5 is vulnerable. The flaw applies to all multisite networks where at least one site administrator has access to the plugin functions.

The exploit requires only a legitimate site‑administrator login and can be performed from the normal admin interface, making it relatively easy to execute for anyone with those credentials. The CVSS score of 5.5 indicates moderate severity because a single compromised site admin can alter settings for the entire network. The EPSS score of 0.00132 indicates a very low probability of exploitation, and the issue is not yet listed in the CISA KEV catalog, but the absence of an authorization check poses a significant risk of misconfiguration or persistent malicious changes.