---
id: CVE-2026-104755
title: >-
  WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to
  'group'/'setting'/'value' Parameters on comms Endpoint
summary: >-
  The WP Compress – Instant Performance & Speed Optimization plugin for
  WordPress is vulnerable to Privilege Escalation in all versions up to, and
  including, 7.25.00 The vulnerability exists because the `start_comms`
  dispatcher (`wps_ic_co…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-269
vendor: aresit
product: WP Compress – Instant Performance & Speed Optimization
affected:
  - wp_compress_instant_performance_speed_optimization <= 7.25.00
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T06:41:04.957Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104755'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00
tags:
  - cve.org
ingestedAt: '2026-10-16T07:01:11.478Z'
---

## Overview

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

## Affected

- `wp_compress_instant_performance_speed_optimization <= 7.25.00`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.