CVE-2026-104755: CWE-269 Improper Privilege Management in aresit WP Compress – Instant Performance & Speed Optimization

CVE-2026-104755 describes a privilege escalation vulnerability in the WP Compress – Instant Performance & Speed Optimization WordPress plugin (versions up to and including 7.25.00). The vulnerability stems from the `start_comms` dispatcher (`wps_ic_comms::start_comms`), which is invoked on every front-end request and authorizes access solely by comparing a caller-supplied `apikey` parameter against the stored plugin API key. This check lacks WordPress capability verification and nonce validation. Subsequently, unvalidated `group`, `setting`, and `value` parameters are passed to `change_setting()`, which writes them directly into the plugin's settings option without an allow-list. This allows attackers to inject arbitrary permission keys, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role the `manage_wpc_settings` capability, effectively giving plugin-administrator-level control over optimization, CDN, and critical CSS features. The API key needed to bypass authorization can be obtained unauthenticated via the `wpc_send_critical_remote` nopriv AJAX action, where the plugin echoes the stored API key in a JSON response, completing the exploit chain without requiring WordPress login credentials.

An unauthenticated attacker can escalate privileges within the plugin to gain administrative control over its settings and features, including optimization, CDN, and critical CSS management. This could allow unauthorized modification of plugin behavior and potentially impact site performance and security configurations. The overall impact is limited to the plugin's scope and does not directly compromise WordPress core or other plugins. The CVSS 3.1 base score is 4.8 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

No official patch or fix is currently documented in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling or removing the affected plugin version (<=7.25.00) or restricting access to the affected AJAX endpoints if possible. Monitoring for plugin updates from the vendor is recommended to apply an official fix once released.