CVE-2026-120551 in WP Compress Plugin
Summary
by MITRE • 11/03/2026
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress contains a critical authorization bypass flaw affecting all versions up to and including 7.22.01. This vulnerability stems from an improper verification of user privileges during specific administrative actions, allowing unauthenticated actors to interact with sensitive endpoints that should be restricted to authenticated administrators. The core technical failure lies in the logic governing API key validation; specifically, the plugin employs a guard mechanism that checks for the presence of a stored api_key before enforcing authentication requirements. When this key is absent, which occurs during fresh installations or on instances operating in lite or free mode where no premium credentials have been configured, the security check fails open rather than denying access. This design oversight effectively creates an unauthenticated entry point into privileged plugin functionality.
An attacker exploiting this flaw can initiate a sequence of actions that compromise the integrity and performance configuration of the targeted WordPress site. By leveraging the lack of authorization checks, the adversary can link the victim website to an account controlled by them within the WP Compress service infrastructure. This unauthorized linkage allows the attacker to overwrite existing plugin settings with aggressive live-CDN presets, which may significantly alter how content is served and cached for legitimate users. Furthermore, because the guard fails open in these specific scenarios, the attacker gains access to the shared api_key that authenticates all nopriv HMAC-gated endpoints associated with the plugin's external services. Possession of this key provides comprehensive control over critical operational functions, including cache purging operations, file deletion capabilities, and opcode cache invalidation requests.
The operational impact of this vulnerability is substantial, as it enables full remote control over essential caching mechanisms without any prior authentication or privilege escalation on the WordPress platform itself. The ability to purge caches can lead to denial-of-service conditions by forcing excessive regeneration of dynamic content, thereby increasing server load and degrading site performance for end-users. Additionally, the capacity to delete files poses a direct threat to data integrity and availability, potentially removing essential theme assets, plugin resources, or user-uploaded media. The manipulation of opcode cache invalidation can further destabilize application performance by forcing repeated compilation of PHP scripts, leading to increased latency and resource consumption. These actions collectively undermine the reliability and security posture of the affected WordPress installation.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, given that sensitive administrative operations are accessible without valid credentials. From a tactical perspective, this exploitation path corresponds to ATT&CK technique T1505.003, Web Shell: CMS Plugin, in the broader context of establishing persistence or control over web applications through compromised plugins, although here it manifests primarily as configuration manipulation and service abuse rather than code execution on the server itself. The attack vector is classified under Remote Code Execution prerequisites indirectly via administrative takeover, specifically mapping to ATT&CK T1078 Valid Accounts if we consider the hijacked WP Compress account as a form of valid credential usage for external services, or more accurately T1496 Resource Hijacking if used for malicious purposes like crypto-mining through excessive resource consumption.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade the WP Compress plugin to version 7.22.02 or later, where this authorization bypass has been patched by enforcing strict authentication checks regardless of whether an api_key is currently stored in the database. Administrators should also ensure that all WordPress plugins are kept up-to-date with their latest releases to minimize exposure to known vulnerabilities. For environments unable to upgrade immediately due to compatibility constraints, temporary workarounds may include restricting access to wp-admin directories via IP whitelisting or implementing Web Application Firewall rules that block requests targeting the specific endpoints exploited by this vulnerability until a patch can be applied. Additionally, reviewing plugin configurations for any unauthorized changes and resetting api_keys if they have been exposed is recommended to restore secure operational states.