CVE-2026-84757
Deferred Deferred - Pending Action

Unauthenticated Settings Change in WP Compress

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Patchstack

Description
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84757
EUVD
EUVD-2026-70585

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_compress wp_compress to 7.21.28 (inc)
wp_compress wp_compress_plugin to 7.21.28 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated settings change vulnerability in WP Compress plugin versions up to 7.21.28. It allows attackers to modify plugin settings without authentication, potentially altering how the plugin processes images or other media on a WordPress site.

Detection Guidance

Check if your WordPress site is running WP Compress plugin version 7.21.28 or below. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in /wp-content/plugins/wp-compress/ for version details. Look for unauthorized settings changes in the plugin configuration.

Impact Analysis

An attacker could exploit this to change plugin settings, potentially causing performance issues, increased server load, or unauthorized modifications to media files. This could disrupt website functionality or lead to unexpected behavior.

Compliance Impact

This vulnerability allows unauthenticated settings changes in the WP Compress plugin, which could lead to unauthorized modifications of website configurations. For GDPR, this may result in improper data handling or processing if settings are altered to disable security controls. Under HIPAA, unauthorized changes could compromise protected health information safeguards if the plugin manages medical data.

Mitigation Strategies

Update WP Compress to the latest version to address the unauthenticated settings change vulnerability. If immediate update is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart