Authorization Bypass in WP Compress - Instant Performance & Speed Optimization Plugin

CVE-2026-120551

What is CVE-2026-120551?

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is affected by an authorization bypass vulnerability present in all versions up to 7.22.01. This issue arises from inadequate verification of user permissions, enabling unauthenticated attackers to link a victim WordPress site to their own WP Compress account. The exploitation of this vulnerability can lead to the modification of plugin settings to aggressive configurations, as well as the theft of the shared api_key used for accessing critical plugin functionalities. Fresh installations and those operating in lite/free modes are particularly at risk, as this security flaw allows attackers to bypass authentication entirely when no api_key is stored.

References