{"affected":[{"defaultStatus":"unaffected","product":"WP Compress – Instant Performance & Speed Optimization","source":"CNA: Wordfence","vendor":"aresit","versions":[{"lessThanOrEqual":"7.22.01","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120551","cwes":["CWE-862"],"description":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.","epss":{"date":"2026-11-06","percentile":0.16186,"score":0.00248},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794018681095,"publishedAt":1793680986946,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3680035%40wp-compress-image-optimizer&new=3680035%40wp-compress-image-optimizer"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3680035%40wp-compress-image-optimizer&new=3680035%40wp-compress-image-optimizer"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve"}],"remediation":[],"revision":"49ca88c4d5702b6a63e40ce3c859d46bc438e2ee833bc6d5a657b529f58d5f65","sources":[{"modifiedAt":1794018681095,"name":"CNA: Wordfence","retrievedAt":1794020933383,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120551"},{"modifiedAt":1793683112790,"name":"NVD","retrievedAt":1793686583616,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120551"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794020958455,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-120551"}],"ssvc":{"assessedAt":1794018671331,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters","updatedAt":1794020958455}