CVE-2026-104755
Received Received - Intake

Privilege Escalation in WP Compress WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-104755
EUVD
EUVD-2026-102793

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aresit WP Compress – Instant Performance & Speed Optimization 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the WP Compress WordPress plugin allows unauthenticated attackers to escalate privileges. The plugin's API key check lacks proper validation, enabling attackers to inject arbitrary settings. These settings can grant any WordPress role, including Subscriber, admin-equivalent control over the plugin's features.

Detection Guidance

Check for unauthorized changes in the WP Compress plugin settings or WordPress role capabilities. Inspect network traffic for requests to wps_ic_comms::start_comms or wpc_send_critical_remote AJAX actions. Review logs for suspicious API key exposure via wp_send_json_success responses.

Impact Analysis

Attackers could gain full control over your WordPress site's optimization, CDN, and critical-CSS features without needing a login. This could allow them to modify site behavior, inject malicious content, or disrupt services.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR and HIPAA compliance. Uncontrolled plugin access may result in data breaches or unauthorized data processing.

Mitigation Strategies

Update the WP Compress plugin to the latest version beyond 7.25.00. Remove or restrict access to the wps_ic_comms::start_comms dispatcher and wpc_send_critical_remote AJAX action. Audit and reset WordPress roles with unauthorized manage_wpc_settings capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart