WP Compress CVE-2026-120551

Exploitation requires the target to be a fresh WP Compress installation or a lite/free-mode install in which no api_key has yet been stored - the guard fails open only while the stored key is absent, so any site that already holds an api_key is not exploitable through this path. No authentication is required (PR:N) and no user interaction is needed (UI:N) against an eligible target reachable over the network. The limiting factor is therefore deployment state, not attacker privilege: the exposure window is effectively the period between install/activation and first legitimate account linking, which bounds the realistic population of exploitable sites.

This is a genuine but conditional priority, not a blanket critical issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, network-reachable, low-complexity exploitation, and CWE-862 (Missing Authorization) matches the described failure: the plugin's sole guard fails open when no api_key is stored. However, the published base score of 5.3 (C:N/I:L/A:N) understates the actual impact, which the description makes clear is substantial - an attacker who links the site to their own WP Compress account and harvests the shared api_key gains control over all nopriv HMAC-gated endpoints, including cache purging, file deletion, and opcode cache invalidation. That reads as high integrity impact and at least some availability impact rather than a single low-integrity effect, so my independent assessment scores it higher than NVD. The crucial mitigating signal is the precondition stated in the description: the flaw only affects fresh installations or lite/free-mode installs where no api_key is yet stored; a site already holding a stored key is not exploitable. No EPSS score is provided, KEV status is not listed (treat as not KEV-listed), and no verified exploit code is present - only the Wordfence advisory and WordPress trac source/changeset links. The vuln.today decision label is 'this_month', consistent with a serious-but-not-emergency fix cadence. Net: prioritize patching for new or free-tier deployments where the fail-open window is live; established paid installs with a stored key are at materially lower real-world risk.

An attacker identifies a WordPress site running a fresh or lite/free-mode WP Compress install where no api_key has been stored yet, then sends an unauthenticated request to the unprotected linking endpoint to bind the victim site to an attacker-controlled WP Compress account. The attacker overwrites the plugin settings to an aggressive live-CDN preset and reads back the shared api_key, which thereafter authenticates every nopriv HMAC-gated operation. No public exploit identified at time of analysis; the trigger relies on the fail-open guard, which is low-complexity against an eligible target.