EUVD-2026-70585
GHSA-rcfm-4q7x-cq83
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Unauthenticated network exploitation of a missing authorization check; integrity high from unrestricted settings change, availability low from potential service disruption, no confidentiality impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
AnalysisAI
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - remote unauthenticated exploitation is possible against any internet-accessible WordPress installation running WP Compress <= 7.21.28 in its default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.2 is calibrated by the AV:N/AC:L/PR:N/UI:N vector - a fully unauthenticated, low-complexity network attack with no user interaction - which accurately reflects the severity of missing authorization on a WordPress plugin endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WP Compress plugin to a version beyond 7.21.28 as soon as one is available from the WordPress plugin repository or the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running WP Compress version 7.21.28 or earlier and audit current CDN and image-optimization configurations as baseline for detecting unauthorized changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Compress
View allRemote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticate
Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execu
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, mo
The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missi
The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data d
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request For
The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to,
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated m
The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Sc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today