WP Compress Plugin CVE-2026-17608

Exploitation requires two concurrent conditions: first, the target WordPress site must have the WP Compress plugin installed and active in a version at or below 7.10.09; second, an authenticated WordPress administrator must be induced into loading a page or clicking a link controlled by the attacker while their admin session is active (UI:R per CVSS). The attacker themselves requires no authentication and no direct network access to the WordPress admin panel - exploitation is purely browser-mediated through the victim's session. What limits exploitation is the social engineering dependency: the attack cannot be automated against arbitrary targets and requires targeted delivery to a specific administrator. There is no requirement for a non-default plugin configuration; the vulnerable code executes as part of normal plugin menu rendering, meaning any site with the plugin activated is exposed regardless of how it is configured.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects that exploitation is network-accessible with low complexity and requires no attacker privileges, but critically depends on UI:R - an authenticated administrator must be socially engineered into clicking a forged link. This single prerequisite meaningfully reduces real-world exploitability compared to a fully autonomous network attack. The NVD-assigned A:N metric appears inconsistent with the described impact: deleting siteurl or active_plugins will render a WordPress site completely unavailable, which warrants A:H; security teams should treat availability impact as real despite the score. No EPSS data was provided in the input, and KEV status is negative, indicating no confirmed mass exploitation. However, the impact when triggered is severe - even a mid-sized municipal IT team in sopot managing a portfolio of WordPress sites should treat this as urgent patching work given the zero-day recovery effort required if core options are wiped. Wordfence's publication of specific vulnerable line numbers lowers the bar for exploit development even without a ready-made POC.

An attacker identifies a WordPress site running WP Compress 7.10.09 or earlier, then crafts a hidden HTML form or malicious URL that triggers a DELETE or POST action against the plugin's nonce-unprotected admin endpoint. The attacker delivers this link via email, forum post, or compromised third-party site to the site administrator; when the authenticated admin's browser loads the page, it automatically submits the forged request, deleting the siteurl or active_plugins option and rendering the site inaccessible. No public exploit code is currently identified, but Wordfence's published source code references make exploit construction straightforward for a moderately skilled attacker.