WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

Source published

16 Oct 2026 06:41:04 UTC

Source modified

16 Oct 2026 15:09:38 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N