CVE-2026-110651: Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer

Q: Who can exploit this issue?

A user with the WordPress author role or a higher-privileged role can exploit it. This is not described as an unauthenticated attack.

Q: Which installations are affected?

Swift Performance Lite versions before 2.3.7.4 are affected. Installations running version 2.3.7.4 or later are not identified as affected by the provided data.

Q: What should be prioritized during triage?

Identify sites using affected Swift Performance Lite versions and review whether author-level accounts are granted to untrusted users. Upgrade the plugin to version 2.3.7.4 or later.

Published Oct 21, 2026

Updated

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.

Affected Software

1 affected component

Swift Performance Swift Performance Lite<2.3.7.4

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress author role or a higher-privileged role can exploit it. This is not described as an unauthenticated attack.

Which installations are affected?

Swift Performance Lite versions before 2.3.7.4 are affected. Installations running version 2.3.7.4 or later are not identified as affected by the provided data.

What should be prioritized during triage?

Identify sites using affected Swift Performance Lite versions and review whether author-level accounts are granted to untrusted users. Upgrade the plugin to version 2.3.7.4 or later.