CVE-2026-104755

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

CVE-2026-104755 WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

EUVD-2026-102793

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

CVE-2026-104755

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress (versions ¢= 7.25.00 ) is vulnerable to unauthenticated privilege escalation . The flaw exists in the wps_ic_comms::start_comms dispatcher, which validates the apikey parameter without a nonce or capability check, the...

CVE-2026-104755: Improper Privilege Management

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher wpsiccomms::startcomms, hooked on every front-end request, gates access on...

WordPress WP Compress plugin <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint vulnerability

Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.25.00...

CVE-2026-84757

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

CVE-2026-84757 WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

CVE-2026-84757 WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

CVE-2026-84757

CVE-2026-84757 affects the WordPress WP Compress plugin in versions 7.21.28 and earlier . The vulnerability is an unauthenticated Settings Change , meaning an attacker with no prior access can modify plugin settings over the network without any user interaction. This yields a CVSS 3.1 base score ...

EUVD-2026-70585

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

CVE-2026-84757: Missing Authorization

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

PT-2026-85100

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

Settings Change vulnerability discovered by Thaer.Assfour in WordPress Plugin WP Compress versions = 7.21.28...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

EUVD-2026-60774

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73343

WP Compress is a WordPress image optimization plugin. An unauthenticated Remote Code Execution (RCE) vulnerability affects versions prior to 7.20.01 , allowing a remote attacker with no prior access to execute arbitrary code on the host, resulting in full compromise of confidentiality, integrity,...