---
id: CVE-2026-104755
title: >-
  The WP Compress – Instant Performance & Speed Optimization plugin for
  WordPress is vulnerable to Privilege Escalation in all versions up to, and
  including, 7.25.00 The vulnerability exists because the `start_comms`
  dispatcher (`wps_ic_co…
summary: >-
  The WP Compress – Instant Performance & Speed Optimization plugin for
  WordPress is vulnerable to Privilege Escalation in all versions up to, and
  including, 7.25.00 The vulnerability exists because the `start_comms`
  dispatcher (`wps_ic_co…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-269
vendor: aresit
product: WP Compress – Instant Performance & Speed Optimization
affected:
  - wp_compress_instant_performance_speed_optimization <= 7.25.00
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:17:03.683'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104755'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/addons/criticalCss/criticalCss.php#L409
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/ajax.class.php#L816
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L1042
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/comms.class.php#L49
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.10.03/classes/users.class.php#L30
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3734610%40wp-compress-image-optimizer%2Ftags%2F7.26.00&old=3723132%40wp-compress-image-optimizer%2Ftags%2F7.25.00
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.0031
epssPercentile: 0.23664
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T14:55:02.789066Z'
ingestedAt: '2026-10-16T07:01:11.478Z'
---

## Overview

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service returns an `apiResults` field, `initCritical()` echoes the stored plugin API key back to the caller in a `wp_send_json_success` response, completing the exploit chain entirely without a WordPress login.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.