The WP Compress – Image Optimizer plugin for WordPress suffers from a missing capability check (CWE-862) in multiple functions, enabling authenticated users with low-level privileges (subscriber and above) to alter plugin settings without proper authorization. This flaw can be exploited in multisite setups to inject cross-site scripting (XSS) payloads. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily due to unauthorized modification of plugin data and potential XSS injection. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Authenticated attackers with subscriber-level permissions or higher can modify plugin settings without proper authorization, potentially injecting cross-site scripting payloads in multisite WordPress environments. This could lead to unauthorized changes in plugin behavior and client-side script execution affecting users of the multisite network. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor multisite environments for unauthorized changes to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users.