Wp Compress Instant Performance Speed Optimization
Monthly
Unauthenticated privilege escalation in the WP Compress - Instant Performance & Speed Optimization plugin for WordPress (all versions up to and including 7.25.00) allows remote attackers with no WordPress account to gain plugin-administrator-equivalent control over the plugin's optimization, CDN and critical-CSS settings. The chain is two-stage: the stored plugin API key is first leaked by the unauthenticated `wpc_send_critical_remote` nopriv AJAX action, but only when the external critical-CSS service returns an `apiResults` field that causes `initCritical()` to echo the key via `wp_send_json_success`; the harvested key is then replayed as the `apikey` parameter to the `start_comms` dispatcher, which performs no capability check and no nonce verification before passing attacker-controlled `group`, `setting` and `value` parameters into `change_setting()`, writing them into the `WPS_IC_SETTINGS` option without an allow-list and causing `checkAndAddCaps()` to grant the `manage_wpc_settings` capability to arbitrary roles, including Subscriber. The assessed severity is moderate - CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) - unauthenticated per the vector (PR:N) but rated high complexity because the API-key disclosure depends on the external critical-CSS service response; impact is scoped to the plugin's settings surfaces rather than full WordPress site administration, and no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.
Unauthenticated privilege escalation in the WP Compress - Instant Performance & Speed Optimization plugin for WordPress (all versions up to and including 7.25.00) allows remote attackers with no WordPress account to gain plugin-administrator-equivalent control over the plugin's optimization, CDN and critical-CSS settings. The chain is two-stage: the stored plugin API key is first leaked by the unauthenticated `wpc_send_critical_remote` nopriv AJAX action, but only when the external critical-CSS service returns an `apiResults` field that causes `initCritical()` to echo the key via `wp_send_json_success`; the harvested key is then replayed as the `apikey` parameter to the `start_comms` dispatcher, which performs no capability check and no nonce verification before passing attacker-controlled `group`, `setting` and `value` parameters into `change_setting()`, writing them into the `WPS_IC_SETTINGS` option without an allow-list and causing `checkAndAddCaps()` to grant the `manage_wpc_settings` capability to arbitrary roles, including Subscriber. The assessed severity is moderate - CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) - unauthenticated per the vector (PR:N) but rated high complexity because the API-key disclosure depends on the external critical-CSS service response; impact is scoped to the plugin's settings surfaces rather than full WordPress site administration, and no public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis.
Cross-Site Request Forgery in WP Compress - Instant Performance & Speed Optimization (all versions through 7.10.09) allows unauthenticated attackers to delete arbitrary WordPress options - including siteurl, home, active_plugins, template, and stylesheet - by tricking an authenticated site administrator into clicking a crafted link. Successful exploitation can cause complete site outage or silently reset all active plugins and themes, effectively wiping the site's operational configuration. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though Wordfence has published detailed code-level references identifying the vulnerable functions.