The WP Compress plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in its AJAX functions, allowing authenticated users with low privileges (Subscriber-level and above) to perform unauthorized actions. These actions include retrieving sensitive settings, modifying, or deleting configuration data, which compromises the confidentiality, integrity, and availability of the plugin's data and functionality. The vulnerability affects all versions up to and including 6.30.15. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Exploitation allows authenticated users with minimal privileges to access and manipulate sensitive plugin settings and configurations. This can lead to disclosure of sensitive information, disruption or loss of plugin functionality, and degradation of overall site performance. The vulnerability impacts confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to the plugin's AJAX functions. Avoid granting Subscriber-level or higher access to untrusted users. Follow the vendor's updates closely for any forthcoming patches or official mitigations.