Description

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T07:16:30.663Z",
  "pubdate": "2026-08-16T07:16:30.663Z",
  "executiveSummary": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 7.10.09. This security flaw stems from the complete absence or incorrect validation of cryptographic nonces within the top-level template code function of the plugin. The architectural oversight permits unauthenticated external entities to induce authenticated administrative users into executing malicious requests via social engineering vectors, such as enticing them to click on a specifically crafted hyperlink.\nSuccessful exploitation of this vulnerability grants remote attackers the capability to arbitrarily delete critical WordPress options stored in the database. Affected database entries include core configuration directives such as siteurl, home, active_plugins, template, and stylesheet. The deletion of these pivotal parameters immediately instigates a comprehensive denial of service (DoS) state, precipitating a total site outage, complete layout destruction, or a full reset of all active plugins and themes. The risk implication is critically high due to the catastrophic impact on site availability and structural integrity, requiring immediate defensive intervention.",
  "technicalDetails": "The root cause of the vulnerability resides in the top-level template code function handling administrative actions within the WP Compress – Instant Performance & Speed Optimization plugin. The function processes state-changing operations without verifying a cryptographic nonce or verifying the intended request origin. Because the application fails to validate whether the incoming HTTP request originated from a legitimate administrative session intended to perform the specific action, the endpoint is exposed to Cross-Site Request Forgery (CSRF).\nThe affected component comprises the core codebase of the WP Compress – Instant Performance & Speed Optimization plugin for WordPress, specifically impacting all versions up to and including 7.10.09. The vulnerability is exploitable over the network via standard HTTP/HTTPS protocols, requiring no prior authentication or administrative privileges for the attacker. However, successful exploitation mandates interaction from a privileged user—specifically, an authenticated site administrator who must be tricked into visiting a malicious web page or clicking a forged link containing the attack payload.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTML document or script containing an automated HTTP request, such as a hidden form submission or an embedded image tag pointing directly to the vulnerable function within the target WordPress site. Second, the attacker delivers this payload to a site administrator using social engineering techniques, such as phishing emails or malicious external websites. Third, when the authenticated site administrator views the malicious content while maintaining an active administrative session, the browser automatically attaches the necessary session cookies and dispatches the forged request to the vulnerable WordPress instance.\nFourth, the WP Compress plugin processes the incoming request through its top-level template code function. Due to the missing or incorrect nonce validation, the application treats the request as a legitimate administrative action. Fifth, the payload executes database query operations that target and delete arbitrary WordPress options. The removal of critical records such as siteurl, home, active_plugins, template, and stylesheet corrupts the core operational parameters of the WordPress installation. Post-exploitation impact results in immediate site instability, broken routing configurations, deactivation of all plugins, and a complete site outage or theme reset, effectively disabling the web application."
}