PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104755 aresit CVE debrief

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00. The vulnerability exists because the `start_comms` dispatcher, hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces.

Vendor
aresit
Product
WP Compress – Instant Performance & Speed Optimization
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-16
Advisory published
2026-10-16
Advisory updated
2026-10-16

Who should care

WordPress administrators, security teams, and developers using the WP Compress plugin should assess their exposure and take immediate action to restrict unauthorized access to the plugin's settings.

Why it matters

The WP Compress plugin for WordPress is vulnerable to Privilege Escalation, allowing unauthenticated attackers to achieve plugin-administrator-equivalent control. Defenders should prioritize verifying exposure and taking immediate action to restrict unauthorized access.

  • Unauthenticated attackers can achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces.
  • Arbitrary permission keys can be written into the plugin's settings, allowing for privilege escalation.
  • The vulnerability can be exploited without authentication or WordPress capability checks.
  • Verification of exposure and remediation is required to prevent potential security breaches.

Technical summary

The WP Compress plugin for WordPress is vulnerable to Privilege Escalation due to improper validation of API keys and request parameters in the `start_comms` dispatcher. This allows unauthenticated attackers to write arbitrary permission keys into the plugin's settings, granting them plugin-administrator-equivalent control. The vulnerability exists in all versions up to, and including, 7.25.00 of the WP Compress plugin. Defenders should prioritize verifying exposure of WordPress installations using the WP Compress plugin, especially those with untrusted front-end access. Immediate action is required to restrict unauthorized access to the plugin's settings and ensure proper validation of API keys and request.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the WP Compress plugin, especially those with untrusted front-end access. Immediate action is required to restrict unauthorized access to the plugin's settings and ensure proper validation of API keys and request parameters.

Recommended defensive actions

  • Verify exposure of WordPress installations using the WP Compress plugin
  • Restrict unauthorized access to the plugin's settings
  • Ensure proper validation of API keys and request parameters
  • Update to a fixed version of the WP Compress plugin when available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide detailed information about the vulnerability, including its existence in all versions up to and including 7.25.00 of the WP Compress plugin, and the specific code paths that allow for privilege escalation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104755 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104755

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104755 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104755

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.