CVE-2026-104755

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start comms dispatcher (wps ic comms::start comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change setting(), which writes them into the WPS IC SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps ic users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage wpc settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc send critical remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp send json success response, completing the exploit chain entirely without a WordPress login.