FKIE_CVE-2026-4127
Vulnerability from fkie_nvd - Published: 2026-03-21 04:17 - Updated: 2026-04-24 16:27
Severity ?
Summary
The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()` function, which handles the `wp_ajax_speedup01_enabled` AJAX action, does not perform any capability check via `current_user_can()` and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., `speedup01_ajax_install_iox` and `speedup01_ajax_delete_cache_file`) which properly check for `install_plugins` and `manage_options` capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site's optimization module by sending a POST request to admin-ajax.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()` function, which handles the `wp_ajax_speedup01_enabled` AJAX action, does not perform any capability check via `current_user_can()` and also lacks nonce verification. This is in contrast to other AJAX handlers in the same plugin (e.g., `speedup01_ajax_install_iox` and `speedup01_ajax_delete_cache_file`) which properly check for `install_plugins` and `manage_options` capabilities respectively. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable the site\u0027s optimization module by sending a POST request to admin-ajax."
},
{
"lang": "es",
"value": "El plugin Speedup Optimization para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 1.5.9 inclusive. La funci\u00f3n speedup01_ajax_enabled(), que maneja la acci\u00f3n AJAX wp_ajax_speedup01_enabled, no realiza ninguna comprobaci\u00f3n de capacidad a trav\u00e9s de current_user_can() y tambi\u00e9n carece de verificaci\u00f3n de nonce. Esto contrasta con otros manejadores AJAX en el mismo plugin (por ejemplo, speedup01_ajax_install_iox y speedup01_ajax_delete_cache_file) que comprueban correctamente las capacidades install_plugins y manage_options respectivamente. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, habiliten o deshabiliten el m\u00f3dulo de optimizaci\u00f3n del sitio enviando una solicitud POST a admin-ajax."
}
],
"id": "CVE-2026-4127",
"lastModified": "2026-04-24T16:27:44.277",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "security@wordfence.com",
"type": "Primary"
}
]
},
"published": "2026-03-21T04:17:41.393",
"references": [
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/speedup-optimization/tags/1.5.9/speedup-optimization.php#L172"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/speedup-optimization/tags/1.5.9/speedup-optimization.php#L178"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/speedup-optimization/trunk/speedup-optimization.php#L172"
},
{
"source": "security@wordfence.com",
"url": "https://plugins.trac.wordpress.org/browser/speedup-optimization/trunk/speedup-optimization.php#L178"
},
{
"source": "security@wordfence.com",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f37c650-af0d-4474-9c1b-7f8d361b4d81?source=cve"
}
],
"sourceIdentifier": "security@wordfence.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security@wordfence.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…