Speed Optimizer plugins prior to version 7.8.5 allow site administrators who are not Super Administrators to use the enable-option or disable-option actions to create or overwrite entire multisite network options without proper privilege verification. This flaw is a privilege escalation issue caused by missing authorization checks, allowing an attacker to modify configuration across all sites in a multisite network. The result can be unauthorized feature toggling, configuration tampering, and potential disruption or compromise of network‑wide functionality.

Any WordPress installation that employs the Speed Optimizer plugin in a version earlier than 7.8.5 is vulnerable. The flaw applies to all mult site networks where at least one site administrator has access to the plugin functions.

The exploit requires only a legitimate site‑administrator login and can be performed from the normal admin interface, making it relatively easy to execute for anyone with those credentials. Although the CVSS score is not listed, the severity is high because a single compromised site admin can alter settings for the entire network. EPSS data is not available and the issue is not yet listed in the CISA KEV catalog, but the lack of an authorization check poses a significant risk of misconfiguration or persistence of malicious changes.