Privilege Escalation Vulnerability in WP Compress Plugin for WordPress

CVE-2026-104755

What is CVE-2026-104755?

The WP Compress plugin for WordPress contains a serious vulnerability that allows unauthenticated attackers to escalate their privileges. This weakness stems from the lack of appropriate capability checks and nonce verification in the start_comms dispatcher. It directly exposes the plugin's settings to manipulation via user-supplied parameters, enabling unauthorized individuals to alter key settings. Attackers can extract the plugin's API key through an unprotected AJAX action, thereby gaining control over critical features such as optimization settings and CDN services without requiring user authentication. This potential breach poses significant risks to WordPress installations utilizing the affected versions of the plugin.

References