{"schema":"threatline.record/2","record":{"id":"CVE-2026-104755","aliases":[],"summary":"WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint","details":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.","categories":["Unclassified"],"product":"WP Compress – Instant Performance & Speed Optimization","vendor":"aresit","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104755","source_modified_at":"2026-10-16T15:09:38.262Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"WP Compress – Instant Performance & Speed Optimization","vendor":"aresit","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.25.00","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0031,"percentile":0.22604,"score_date":"2026-10-23"},"published_at":"2026-10-16T06:41:04.957Z","modified_at":"2026-10-16T15:09:38.262Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104755","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T15:09:38.262Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104755","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T14:55:02.789066Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T15:09:38.262Z","content_hash":"c441b93a4eb03a03a1dce41be769bdd1fbde40c86a30f65b5e72f6fa212c8ce4"}}