EUVD-2026-70585
GHSA-rcfm-4q7x-cq83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with WP Compress installed
-
DeliverySend unauthenticated HTTP request to settings endpoint
-
ExploitMissing authorization check bypassed (CWE-862)
-
ExecutionPlugin settings overwritten
-
ImpactRedirect CDN/API traffic or degrade site integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - remote unauthenticated exploitation is possible against any internet-accessible WordPress installation running WP Compress <= 7.21.28 in its default configuration. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, elevated privileges, or user interaction is needed. The only limiting factors are: the target site must have the WP Compress plugin installed and active, and the affected endpoint must be reachable over the network (i.e., not blocked by a WAF or IP allowlist on the WordPress AJAX/REST layer). There is no dependency on non-default configuration settings. |
| Impact | The CVSS base score of 8.2 is calibrated by the AV:N/AC:L/PR:N/UI:N vector - a fully unauthenticated, low-complexity network attack with no user interaction - which accurately reflects the severity of missing authorization on a WordPress plugin endpoint. The impact metrics (C:N/I:H/A:L) are plausible: settings manipulation yields high integrity impact (CDN URLs, API keys, optimization behavior altered) and low availability impact (service degradation rather than full outage). No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, meaning there is no confirmed evidence of active exploitation. However, the attack conditions are extremely permissive - any internet-facing WordPress site with the plugin installed is potentially vulnerable without any prerequisite. WordPress plugin vulnerabilities with this profile (unauthenticated, AV:N/AC:L/PR:N) are routinely targeted by automated mass-scanning tools within days of disclosure, elevating urgency above what the missing KEV flag might suggest. POC status is unknown. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running WP Compress <= 7.21.28 via passive scanning or a public list of plugin installations, then sends a crafted HTTP POST request to the exposed settings endpoint, bypassing all authorization checks. The attacker modifies the plugin's CDN or API configuration to point to an attacker-controlled domain, enabling traffic redirection or delivery of manipulated assets to site visitors. No credentials, prior access, or user interaction are required to complete the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.
RemediationAI
Update the WP Compress plugin to a version beyond 7.21.28 as soon as one is available from the WordPress plugin repository or the vendor. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-plugin-7-21-28-settings-change-vulnerability?_s_id=cve should be consulted for the confirmed patched release version, which was not independently specified in the available input data. As an interim workaround, administrators who cannot immediately update should consider deactivating the WP Compress plugin until a patch is applied, or restricting access to the WordPress admin and AJAX endpoints (wp-admin/, wp-login.php, admin-ajax.php) to trusted IP ranges via web server or WAF rules - noting that this latter control may break legitimate plugin functionality for front-end users. The Patchstack firewall virtual patch also provides protection for Patchstack subscribers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Compress (CPE: cpe:2.3:a:aresit:wp_compress:*:*:*:*:*:*:*:*) is a WordPress image optimizer and CDN acceleration plugin developed by aresit. CWE-862 (Missing Authorization) describes a failure to verify that the requesting user or process has permission to perform an action before executing it - in WordPress plugin terms, this typically means the relevant AJAX handler or REST endpoint omits a capability check (e.g., current_user_can()) or nonce validation tied to a capability. Because WordPress serves admin-registered endpoints to all requestors including unauthenticated visitors, the absence of such a check exposes the settings-change functionality to the public internet. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication or user interaction is required.
Know when Wp Compress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Unauthenticated network exploitation of a missing authorization check; integrity high from unrestricted settings change, availability low from potential service disruption, no confidentiality impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
Executive ViewAI
Organizations running WP Compress WordPress plugin version 7.21.28 or earlier face a critical exposure: unauthenticated attackers can directly modify plugin settings, including CDN endpoints and image-optimization configurations, affecting content delivery site-wide. Although no public exploit code has been identified at time of analysis, the trivial attack complexity and network accessibility of this flaw make it a high-priority remediation target for any WordPress deployment using this plugin.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) deactivate the plugin until a security update is released, (2) deploy Web Application Firewall rules to block unauthenticated POST requests to WP Compress settings endpoints, (3) restrict access to administrative configuration pages by IP whitelist to known internal or administrative networks, (4) enable granular logging and alerting on plugin configuration changes to detect unauthorized modification attempts, and (5) maintain baseline snapshots of CDN and optimization settings to facilitate rapid anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wp Compress
View allRemote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticate
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execu
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, mo
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress allows Cross Site Request Forgery.30.30. Rated hig
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data d
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request For
A security vulnerability in AresIT WP Compress allows Authentication Abuse (CVSS 5.3). Remediation should follow standar
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to,
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated m
Exploit-DB