The Swift Performance Lite plugin for WordPress contains an authorization bypass vulnerability (CWE-863) due to the absence of a capability check in the ajax_handler() function. This flaw permits authenticated users with minimal privileges (subscriber-level and above) to access and alter plugin settings. The vulnerability affects all versions up to and including 2.3.6.18. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no indication of known exploits in the wild or an official patch at this time.

An attacker with subscriber-level access or higher can exploit this vulnerability to retrieve and modify settings of the Swift Performance Lite plugin. This could lead to unauthorized changes in plugin behavior or configuration, potentially affecting website performance or security posture. The vulnerability does not allow for denial of service or privilege escalation beyond the existing authenticated user level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for unusual changes in plugin settings. Avoid granting unnecessary privileges to low-level authenticated users.