{"id":"CVE-2026-104755","kind":"vulnerability","aliases":["CVE-2026-104755"],"related":[],"title":"WP Compress WordPress plugin: unauthenticated users gain plugin admin rights","description":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.","summary":"The WP Compress WordPress plugin, through version `7.25.00`, lets unauthenticated visitors write arbitrary permission keys into its settings and grant any WordPress role, including Subscriber, the `manage_wpc_settings` capability. The API key needed for that check can be fetched without login through a public AJAX action, so an attacker gets plugin-administrator control over optimization, CDN and critical-CSS settings.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-compress"],"not_affected_if":["plugin-not-installed","versions-above-7.25.00"],"how_to_check":"- Check the installed WP Compress version in the WordPress admin plugin list; versions up to and including `7.25.00` are affected.\n- Look for users with the `manage_wpc_settings` capability or unexpected Subscriber accounts with plugin settings changes.\n- Review the `WPS_IC_SETTINGS` option in the database for unexpected permission keys.","fix":"- Update WP Compress to a release newer than `7.25.00`; the sources do not name the fixed version.\n- Remove the `manage_wpc_settings` capability from any role that should not have it.\n- Rotate the plugin API key after updating.","status":"open","published_at":"2026-10-16T07:17:08+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:34:56+00:00","updated_at":"2026-10-25T04:34:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:34:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Compress to a release newer than `7.25.00`; the sources do not name the fixed version.\n- Remove the `manage_wpc_settings` capability from any role that should not have it.\n- Rotate the plugin API key after updating.","reach":"internet","title":"WP Compress WordPress plugin: unauthenticated users gain plugin admin rights","impact":"medium","summary":"The WP Compress WordPress plugin, through version `7.25.00`, lets unauthenticated visitors write arbitrary permission keys into its settings and grant any WordPress role, including Subscriber, the `manage_wpc_settings` capability. The API key needed for that check can be fetched without login through a public AJAX action, so an attacker gets plugin-administrator control over optimization, CDN and critical-CSS settings.","category":"package","nicknames":[],"who_cares":["wordpress","wp-compress","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains plugin admin control and role capabilities","analyst_note":"","how_to_check":"- Check the installed WP Compress version in the WordPress admin plugin list; versions up to and including `7.25.00` are affected.\n- Look for users with the `manage_wpc_settings` capability or unexpected Subscriber accounts with plugin settings changes.\n- Review the `WPS_IC_SETTINGS` option in the database for unexpected permission keys.","needs_analyst":false,"not_affected_if":["plugin-not-installed","versions-above-7.25.00"],"who_is_affected":"Sites running the WP Compress plugin at version `7.25.00` or older are exposed, because the flaw is reachable on every front-end request without a login. Sites that do not have the plugin installed, or run a newer version, are not affected. The sources do not say whether default settings are sufficient for exploitation.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.001275,"input_tokens":3704,"output_tokens":1809,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104755':13A,16A '-2026':12A,15A '7.25.00':32B,110C 'access':132C 'achiev':220C 'action':71B,260C 'admin':9A 'administr':78B,223C 'ajax':70B,259C 'allow':182C 'allow-list':181C 'api':56B,146C,238C,277C 'apikey':140C 'apiresult':270C 'arbitrari':37B,193C 'attack':74B,190C 'authent':251C 'author':244C 'back':279C 'caller':138C,282C 'caller-suppli':137C 'capabl':54B,151C,217C 'caus':201C 'cdn':82B,231C 'chain':293C 'chang':168C 'check':61B,152C,245C 'checkandaddcap':205C 'comm':117C,121C,123C 'compar':135C 'complet':290C 'compress':2A,24B,27B,90C 'control':79B,225C 'critic':85B,234C,256C,265C 'critical-css':84B,233C,264C 'css':86B,235C,266C 'cve':11A,14A 'direct':166C 'dispatch':118C 'echo':273C 'end':129C 'entir':294C 'equival':224C 'escal':102C 'everi':126C 'exist':113C 'exploit':292C 'extern':263C 'fetch':64B 'field':271C 'front':128C 'front-end':127C 'gain':7A 'gate':131C 'get':75B 'grant':44B,207C 'group':161C 'hook':124C 'host':20B 'ic':120C,176C,203C 'includ':48B,109C,211C 'initcrit':272C 'instant':91C 'json':287C 'key':39B,57B,147C,195C,239C,278C 'let':33B 'list':183C 'login':66B,298C 'make':185C 'manag':51B,214C 'need':58B 'nonc':155C 'nopriv':258C 'obtain':249C 'optim':81B,94C,230C 'option':178C 'packag':17B 'paramet':141C,165C 'pass':158C,242C 'perform':92C 'permiss':38B,194C 'plugin':4A,8A,29B,77B,95C,145C,198C,222C,228C,276C 'plugin-administr':76B 'plugin-administrator-equival':221C 'possibl':187C 'privileg':101C 'public':69B 'remot':257C 'request':130C 'requir':240C 'respons':289C 'return':268C 'right':10A 'role':47B,210C 'self':19B 'self-host':18B 'send':255C,286C 'servic':267C 'set':42B,53B,87B,162C,169C,177C,200C,216C 'speed':93C 'start':116C,122C 'store':144C,275C 'subscrib':49B,212C 'success':288C 'suppli':139C 'surfac':236C 'therebi':219C 'unauthent':5A,34B,189C 'unvalid':160C 'user':6A,204C 'valu':164C 'verif':156C 'version':31B,105C 'via':252C 'visitor':35B 'vulner':99C,112C 'without':65B,179C,250C,295C 'wordpress':3A,21B,28B,46B,97C,150C,209C,297C 'wp':1A,23B,26B,89C,285C 'wp-compress':22B 'wpc':52B,215C,254C 'wps':119C,175C,202C 'write':36B,171C,192C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Compress plugin at version `7.25.00` or older are exposed, because the flaw is reachable on every front-end request without a login. Sites that do not have the plugin installed, or run a newer version, are not affected. The sources do not say whether default settings are sufficient for exploitation.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104755","severity":null,"published_at":"2026-10-16T07:17:08+00:00","modified_at":"2026-10-16T15:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}