Live › vulnerability › CVE-2026-104755
Go to dashboardThe WP Compress WordPress plugin, through version `7.25.00`, lets unauthenticated visitors write arbitrary permission keys into its settings and grant any WordPress role, including Subscriber, the `manage_wpc_settings` capability. The API key needed for that check can be fetched without login through a public AJAX action, so an attacker gets plugin-administrator control over optimization, CDN and critical-CSS settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Compress plugin at version or older are exposed, because the flaw is reachable on every front-end request without a login. Sites that do not have the plugin installed, or run a newer version, are not affected. The sources do not say whether default settings are sufficient for exploitation.
7.25.00No product ranges from the sources yet.
7.25.00 are affected.manage_wpc_settings capability or unexpected Subscriber accounts with plugin settings changes.WPS_IC_SETTINGS option in the database for unexpected permission keys.7.25.00; the sources do not name the fixed version.manage_wpc_settings capability from any role that should not have it.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.
This page as .md · .json · in your agent: get_signal("CVE-2026-104755")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.