WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

Summary

CVE	CVE-2026-104755
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-10-16 07:17:08 UTC
Updated	2026-10-16 15:17:03 UTC
Description	The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

Risk And Classification

Primary CVSS: v3.1 4.8 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Problem Types: CWE-269 | CWE-269 CWE-269 Improper Privilege Management

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	4.8	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`
3.1	CNA	DECLARED	4.8	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Aresit	WP Compress Instant Performance Speed Optimization	affected 7.25.00 semver	Not specified

References

Reference	Source	Link	Tags
www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b...	[email protected]	www.wordfence.com
plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criti...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comm...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/user...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comm...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/changeset	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Wordfence PRISM (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-10-02T12:30:28.000Z	Vendor Notified
CNA	2026-10-15T17:35:06.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.