Skip to main content

WP Compress EUVDEUVD-2026-60774

| CVE-2026-73343 CRITICAL
Code Injection (CWE-94)
2026-08-18 Patchstack GHSA-9q2c-g54m-wgqw
Code Injection RCE Wp Compress
10.0
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
10.0 CRITICAL

Unauthenticated remote code injection reachable over the network with low complexity gives AV:N/AC:L/PR:N/UI:N; PHP execution beyond the plugin justifies S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Aug 18, 2026 - 15:08 vuln.today
Patch available
Aug 18, 2026 - 15:02 EUVD
CVE Published
Aug 18, 2026 - 14:00 cve.org
CRITICAL 10.0

DescriptionCVE.org

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

AnalysisAI

Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site running WP Compress
Delivery
Send crafted request to plugin endpoint
Exploit
Inject arbitrary PHP code (CWE-94)
Execution
Execute code as web server user
Impact
Full server compromise across scope
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The only prerequisite established by the data is that a target WordPress site runs the WP Compress (Image Optimizer) plugin at a version below 7.20.01 and exposes the vulnerable endpoint to the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All available signals point to top-tier priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields 10.0, indicating remote, low-complexity, unauthenticated exploitation with a scope change and full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scans internet-facing WordPress sites, fingerprints the WP Compress plugin, and sends a crafted unauthenticated request to a vulnerable plugin endpoint containing a code-injection payload. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the payload is evaluated as PHP, giving the attacker arbitrary command execution and a foothold on the server. …
Remediation Patch available per vendor advisory: upgrade the WP Compress plugin to version 7.20.01 or later, which is the first fixed release, via the WordPress plugin updater or by downloading the patched package from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all WordPress installations to identify WP Compress plugin versions and immediately disable or remove any versions prior to 7.20.01. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wp Compress

View all
CVE-2026-9066 MEDIUM POC
6.1 Jul 23

Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execu
CVE-2025-2110 HIGH
8.8 Mar 26

The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, mo
CVE-2024-1934 HIGH
7.5 Apr 09

The WP Compress - Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missi
CVE-2024-4445 MEDIUM
6.5 May 14

The WP Compress - Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data d
CVE-2025-2109 MEDIUM
5.8 Mar 25

The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request For
CVE-2023-6812 MEDIUM
4.3 May 14

The WP Compress - Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to,
CVE-2024-32106 MEDIUM
4.3 Apr 11

Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress - Image Optimizer [All-In-One].10.35. Rated m
CVE-2024-12047 MEDIUM
6.1 Jan 04

The WP Compress - Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Sc

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

EUVD-2026-60774 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy