The Speedup Optimization plugin for WordPress allows any authenticated user with at least Subscriber level access to toggle the optimization engine on or off through an AJAX endpoint that performs no capability checks or nonce verification. The flaw arises in the speedup01_ajax_enabled() handler, which omits any call to current_user_can() and does not validate a security nonce. Because the endpoint accepts a POST request to admin-ajax.php with action speedup01_enabled, any logged‑in user can enable or disable the plugin’s optimization module. This results in unauthorized configuration modification that could affect site performance or functionality, but does not provide direct code execution or data exfiltration. The underlying weakness is a missing authorization check (CWE‑862).

WordPress sites that have the Speedup Optimization plugin installed, version 1.5.9 or earlier. The vulnerability affects all instances where the plugin is active, regardless of the overall WordPress version. Users with any authenticated role from Subscriber upwards can trigger the defect via the exposed AJAX action.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% shows low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The exploit path is simple: a legitimate user simply sends a crafted POST request to admin-ajax.php specifying action=speedup01_enabled. No additional privileges or system compromise are required beyond basic authentication, making the vulnerability easily exploitable for those with access to a site account.