WP Compress EUVD-2026-60774

The only prerequisite established by the data is that a target WordPress site runs the WP Compress (Image Optimizer) plugin at a version below 7.20.01 and exposes the vulnerable endpoint to the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation is possible against default configurations of WP Compress, with no authentication, no user interaction, and low attack complexity required. Limiting factors are narrow: exploitation is bounded only to sites that have the plugin installed and activated and not yet updated to 7.20.01; the precise vulnerable feature/endpoint is not disclosed in the provided data, so which specific plugin function is required cannot be confirmed from input alone.

All available signals point to top-tier priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields 10.0, indicating remote, low-complexity, unauthenticated exploitation with a scope change and full confidentiality, integrity, and availability impact. The scope change (S:C) reflects that PHP code execution can affect the whole hosting environment beyond the plugin itself. No EPSS score, KEV listing, or SSVC decision data was provided, so real-world exploitation frequency cannot be quantified from the input; however, the combination of unauthenticated RCE (CWE-94) in an internet-facing WordPress plugin historically attracts rapid mass-scanning once details or a POC surface. The main uncertainty is exploit maturity - no POC is indicated in the data - so risk is currently theoretical-but-severe rather than confirmed in-the-wild. Absence of EPSS/KEV should not be read as low risk given the maximal CVSS and the Patchstack disclosure.

An attacker scans internet-facing WordPress sites, fingerprints the WP Compress plugin, and sends a crafted unauthenticated request to a vulnerable plugin endpoint containing a code-injection payload. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the payload is evaluated as PHP, giving the attacker arbitrary command execution and a foothold on the server. No public POC is identified at time of analysis, but the low complexity makes weaponization straightforward once internals are known.