CVE-2026-104755: WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher (wpsiccomms::startcomms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to changesetting(), which writes them into the WPSICSETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wpsicusers::checkAndAddCaps() to grant any WordPress role — including Subscriber — the managewpcsettings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpcsendcriticalremote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wpsendjsonsuccess response, completing the exploit chain entirely without a WordPress login.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to unauthenticated exploitation?
WP Compress installations running version 7.25.00 or earlier are affected. The vulnerable dispatcher is hooked on every front-end request, so an attacker does not need a WordPress account or an authenticated admin session.
Does exploitation require knowing a secret plugin API key?
The comms endpoint compares a supplied apikey value to the stored plugin API key. However, the description states that this key can be obtained without authentication through the wpc_send_critical_remote nopriv AJAX action when the external critical-CSS service is involved; the provided data is truncated before specifying any further conditions.
What level of access can an attacker gain?
An attacker can write arbitrary permission keys into the plugin settings and cause the plugin to grant any WordPress role, including Subscriber, the manage_wpc_settings capability. This provides plugin-administrator-equivalent control over WP Compress optimization, CDN, and critical-CSS functionality.