The NitroPack – Performance, Page Speed & Cache Plugin for WordPress suffers from a missing authorization check (CWE-862) in the nitropack_set_compression_ajax() function. This flaw allows authenticated users with low privileges (Subscriber-level and above) to update the nitropack-enableCompression option, effectively changing compression settings without proper permission. The vulnerability affects all versions up to 1.18.4. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and the need for authenticated access. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

The vulnerability allows unauthorized modification of plugin compression settings by authenticated users with Subscriber-level access or higher. This could lead to unintended changes in site performance optimization but does not impact data confidentiality or availability according to the CVSS vector. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only to minimize risk. Monitor vendor channels for updates regarding a patch or official mitigation.