CVE-2026-17608 in Compress Plugin
Summary
by MITRE • 08/16/2026
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The WP Compress plugin vulnerability represents a critical cross-site request forgery weakness that affects all versions up to and including 7.10.09, exposing WordPress installations to significant operational risks. This vulnerability stems from inadequate nonce validation within the plugin's top-level template code function, creating a pathway for malicious actors to execute unauthorized administrative actions without proper authentication. The flaw operates at the core of WordPress's security model by bypassing the fundamental protection mechanisms that should prevent unauthorized modifications to critical system configurations.
The technical implementation of this vulnerability allows attackers to craft forged requests that manipulate WordPress options through the compromised plugin interface. When an administrator visits a malicious page or clicks on a crafted link, the CSRF attack can silently execute destructive operations targeting essential WordPress configuration parameters. The vulnerability specifically impacts critical system variables including siteurl, home, active_plugins, template, and stylesheet settings that govern how WordPress functions and presents content to users.
This security gap enables attackers to cause complete site outages or perform comprehensive plugin and theme resets by manipulating the WordPress configuration database entries. The attack vector exploits the trust relationship between administrators and their websites, leveraging social engineering techniques to convince users to interact with malicious content. The impact extends beyond simple data corruption as the compromised settings can render entire websites inaccessible or force unwanted changes to the site's operational behavior.
The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery issues in web applications, and maps to ATT&CK technique T1059.001 for command and scripting interpreter usage in executing malicious operations. Organizations using affected plugin versions face substantial risk of complete site compromise, data loss, and potential unauthorized access to sensitive system information. The lack of proper nonce validation creates an attack surface that can be exploited by attackers with minimal technical expertise.
Mitigation strategies should immediately include updating to the latest plugin version where the nonce validation has been properly implemented, implementing additional security layers such as web application firewalls, and conducting thorough security audits of all installed plugins. Administrators should also consider disabling unnecessary administrative functions and implementing role-based access controls to limit potential damage from successful attacks. Regular monitoring of plugin update notifications and maintaining comprehensive backup strategies remain essential defensive measures against this class of vulnerability.
The broader implications of this vulnerability highlight the critical importance of proper input validation and authentication mechanisms in WordPress plugins, particularly those handling system-level configuration changes. Security practitioners should emphasize the need for regular security assessments of third-party components and maintain awareness of emerging threats targeting popular CMS plugins that serve as common attack vectors for sophisticated adversaries seeking to compromise web infrastructure.