EUVD-2026-60774
GHSA-9q2c-g54m-wgqw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote code injection reachable over the network with low complexity gives AV:N/AC:L/PR:N/UI:N; PHP execution beyond the plugin justifies S:C and full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
AnalysisAI
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite established by the data is that a target WordPress site runs the WP Compress (Image Optimizer) plugin at a version below 7.20.01 and exposes the vulnerable endpoint to the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to top-tier priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields 10.0, indicating remote, low-complexity, unauthenticated exploitation with a scope change and full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans internet-facing WordPress sites, fingerprints the WP Compress plugin, and sends a crafted unauthenticated request to a vulnerable plugin endpoint containing a code-injection payload. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the payload is evaluated as PHP, giving the attacker arbitrary command execution and a foothold on the server. … |
| Remediation | Patch available per vendor advisory: upgrade the WP Compress plugin to version 7.20.01 or later, which is the first fixed release, via the WordPress plugin updater or by downloading the patched package from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify WP Compress plugin versions and immediately disable or remove any versions prior to 7.20.01. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Compress
View allReflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execu
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, mo
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missi
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data d
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request For
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to,
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated m
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Sc
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today