Description

Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-03T17:17:26.660Z",
  "pubdate": "2026-09-03T17:17:26.660Z",
  "executiveSummary": "The WP Compress plugin for WordPress, specifically versions 7.21.28 and below, contains a critical vulnerability related to improper access control.\nThe vulnerability manifests as an unauthenticated settings change, allowing remote, unprivileged attackers to modify plugin configurations without valid credentials.\nThe lack of appropriate authorization checks on sensitive administrative functions permits unauthorized manipulation of plugin parameters.\nSuccessful exploitation exposes the application to potential service disruption or malicious configuration changes, as the attacker can alter operational settings.\nThis flaw necessitates immediate attention as it bypasses the security boundary typically required for administrative interface access.\nThe vulnerability is accessible over the network without requiring prior authentication, significantly increasing the potential attack surface for malicious actors.\nSecurity implications include the compromise of plugin-specific operational integrity and potential escalation into further site-wide impact depending on the specific settings manipulated.",
  "technicalDetails": "The vulnerability exists due to insufficient authorization checks within the WP Compress plugin codebase. The affected versions fail to implement proper capability verification on endpoints responsible for processing plugin setting updates.\nSpecifically, the plugin's internal request handling mechanisms do not enforce adequate nonce verification or user role validation (e.g., 'manage_options') before executing modification routines triggered by incoming HTTP requests.\nAn unauthenticated attacker can construct a crafted HTTP POST request targeting the specific plugin endpoint responsible for updating settings. Because the backend code lacks a conditional check to verify the session or the authorization level of the requester, the application processes the request as if it were a legitimate administrative action.\nThe attack flow proceeds as follows: 1) The attacker identifies the target endpoint exposed by the WP Compress plugin. 2) The attacker crafts a request containing the desired modified configuration parameters. 3) The request is transmitted to the server. 4) The server receives the request, fails to identify the lack of administrative privileges, and proceeds to update the plugin database entries or configuration files based on the malicious input provided in the request body.\nThis vulnerability is classified as an authorization bypass. The root cause is the reliance on client-side or implicit assumptions of security rather than explicit, server-side capability checks at the function entry point. The impact is significant as it allows an external, unauthenticated party to exert control over the operational configuration of the plugin.\nPost-exploitation, the attacker may change settings that could lead to performance degradation, disable critical image optimization functions, or potentially change routing parameters if the plugin supports such configurations. The ease of exploitation via simple HTTP request crafting makes this a high-risk entry point for unauthorized administrative activity on affected WordPress installations."
}