CVE-2026-104755

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.