The Speedup Optimization plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the speedup01_ajax_enabled() function. This function processes the wp_ajax_speedup01_enabled AJAX action but fails to perform capability checks using current_user_can() and does not verify nonces. As a result, authenticated users with low privileges (Subscriber and above) can toggle the optimization module on or off by sending a POST request to admin-ajax.php. This contrasts with other AJAX handlers in the plugin that properly enforce capability checks for sensitive actions. The vulnerability is present in all plugin versions up to and including 1.5.9. No patch or vendor advisory has been provided to date.

An attacker with authenticated access at Subscriber level or higher can enable or disable the optimization module of the Speedup Optimization plugin without proper authorization. This could lead to unintended changes in site performance or behavior. The vulnerability does not allow direct confidentiality or availability impacts beyond this configuration change. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin access to trusted users only and monitor for suspicious POST requests to admin-ajax.php targeting the wp_ajax_speedup01_enabled action. Consider temporarily disabling the plugin if unauthorized changes are suspected.