Vulnerabilities

Vulnerability · CVE-2026-104755

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The…

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · the affected product

Check if you run it

No confirmed exploitation is on record for CVE-2026-104755. EPSS is 0.31%. Act only if a listed version of the affected product is installed.

Severity

Medium4.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.31%

Remediation

Version ranges on file

Affected products

stated named in the record

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the dispatcher ( ), hooked on every front-end request, gates access only by comparing the caller-supplied parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated , , and parameters directly to , which writes them into the option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing to grant any WordPress role — including Subscriber — the capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the nopriv AJAX action: when the external critical-CSS service returns an field, echoes the stored plugin API key back to the caller in a response, completing the exploit chain entirely without a WordPress login.