CVE-2026-84757 in WP Compress Plugin
Summary
by MITRE • 09/03/2026
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified as an unauthenticated settings change within the WP Compress plugin, affecting versions up to and including 7.21.28, represents a critical failure in access control mechanisms that allows remote attackers to modify WordPress configuration without valid credentials or authentication tokens. This flaw stems from insufficient validation of incoming requests on administrative endpoints that are intended for privileged users only. By exploiting this weakness, an attacker can alter core plugin settings such as image optimization parameters, CDN configurations, or caching rules directly through HTTP requests. The absence of nonce verification and proper capability checks means that any user with network access to the WordPress installation can manipulate these sensitive configuration values, effectively bypassing the intended security boundaries established by the Content Management System framework.
From a technical perspective, this issue aligns closely with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site (Open Redirect) if the settings changes involve redirect rules or external service integrations that could be manipulated for malicious redirection. The operational impact of such unauthorized modifications is significant because it can degrade site performance, compromise data integrity, or facilitate further attacks. For instance, an attacker might disable image compression features to increase bandwidth consumption and server load, leading to a denial-of-service condition through resource exhaustion. Alternatively, they could modify CDN endpoints to point to malicious servers, potentially intercepting traffic or injecting malware into static assets served by the platform. In more severe scenarios, altering security-related settings like SSL enforcement or cookie configurations can expose user sessions to interception or hijacking attacks.
This vulnerability also maps to MITRE ATT&CK technique T1505.003 Web Shell: Cloud Services if the modified settings allow for arbitrary file uploads or execution of remote code through misconfigured integrations, although primarily it falls under privilege escalation and configuration manipulation tactics. The ability to change settings without authentication undermines the principle of least privilege and trust boundaries within the WordPress ecosystem. It allows attackers who may have gained initial foothold via other vectors, such as weak passwords or exposed login pages, to escalate their privileges silently by altering backend configurations rather than directly hacking core files. This stealthy approach makes detection more difficult for standard security monitoring tools that focus on file integrity changes rather than database state modifications triggered through API endpoints.
Mitigation strategies must prioritize immediate patching of the WP Compress plugin to a version greater than 7.21.28 where these access control flaws have been addressed by developers implementing strict nonce validation and capability checks for all administrative actions. In environments where updating is not immediately feasible, administrators should restrict access to wp-admin directories using IP whitelisting or two-factor authentication plugins that enforce stronger identity verification before any settings page can be loaded. Additionally, web application firewalls can be configured to detect and block anomalous POST requests targeting specific plugin endpoints known to handle sensitive configuration data. Regular auditing of WordPress database tables for unauthorized changes in option values provides an additional layer of defense against persistent attackers who might attempt to revert patches or exploit residual misconfigurations.