WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

Summary

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

Timeline

1. Oct 16, 2026, 6:41 AM UTCCVE published
2. Oct 16, 2026, 2:55 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 16, 2026, 3:09 PM UTCRecord last updated

Affected versions

• aresit WP Compress – Instant Performance & Speed Optimization

  through 7.25.00

References 7