Aresit
Monthly
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Unauthenticated settings modification in the WP Compress WordPress plugin (versions <= 7.21.28) allows any remote attacker without credentials to alter plugin configuration, potentially redirecting CDN endpoints, disabling image optimization, or manipulating performance settings site-wide. The flaw stems from missing authorization checks (CWE-862) on settings-update endpoints, meaning any internet-reachable WordPress installation running the affected plugin is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity attack vector makes this trivially exploitable by automated scanners.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.