Read the docs
TI-2026-84141 Aliases CVE-2026-120551GHSA-8cqm-xp6w-w8hf

Missing authorization in WP Compress plugin allows site takeover

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The WP Compress WordPress plugin, all versions up to and including 7.22.01, lacks an authorization check (CWE-862). An unauthenticated attacker can link the site to an attacker-controlled WP Compress account and overwrite plugin settings, then obtain the shared API key that authenticates privileged plugin endpoints. The flaw affects only fresh installations or lite/free-mode installs where no API key is stored. Successful attackers gain control over cache purging, file deletion and other privileged plugin operations.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aresitWP Compress – Instant Performance & Speed Optimizationup to 7.22.01—No fix listedCNA
  • WP Compress – Instant Performance & Speed Optimization Vendoraresit Affected up to 7.22.01 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:*:*:*——aresit
  • cpe:2.3:a:wpcompress:wp_compress:*:*:*:*:*:*:*:* Versions — — ·aresit

Remediation

The sources list no fixed version for WP Compress.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-120551
  2. 2026-11-03 Alias added: GHSA-8cqm-xp6w-w8hf
  3. 2026-11-07 CISA SSVC decision points changed

References

Other 5

  • TI-2026-51463 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2025-29976 WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-06126 WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css CVSS 3.1CRITICAL 9.1
  • TI-2026-58258 WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability CVSS 3.1HIGH 8.2
  • TI-2025-01847 WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions CVSS 3.1HIGH 8.8
  • TI-2024-01801 WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences