CVE-2026-17608
Received Received - Intake

Cross-Site Request Forgery in WP Compress WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-17608
EUVD
EUVD-2026-59924

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_compress instant_performance_and_speed_optimization to 7.10.09 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the WP Compress plugin for WordPress. It exists in versions up to 7.10.09 due to missing or incorrect nonce validation on a function. Attackers can exploit this to delete arbitrary WordPress options, including critical ones like siteurl, home, active_plugins, template, and stylesheet. This could cause site outages or reset plugins and themes if an administrator is tricked into clicking a malicious link.

Detection Guidance

This vulnerability involves a Cross-Site Request Forgery (CSRF) in the WP Compress plugin. Detection requires checking if the plugin is installed and its version. Inspect WordPress admin pages for the plugin and verify the version against 7.10.09 or lower. No direct commands are provided in the context to detect this vulnerability.

Impact Analysis

If exploited, this vulnerability could allow attackers to delete important WordPress settings, leading to site crashes or a full reset of plugins and themes. This would disrupt website functionality and require recovery efforts. Users relying on the plugin for performance optimization could face significant downtime.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by allowing unauthenticated attackers to delete critical WordPress options, potentially disrupting site functionality or data handling. If site settings or plugins managing sensitive data are altered, it may lead to unauthorized data exposure or loss, violating compliance requirements for data protection and integrity.

Mitigation Strategies

Immediately update the WP Compress plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Ensure WordPress nonces are properly validated in plugin code to prevent CSRF attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart