Security advisory2026-10-16The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher (wpsiccomms projectSecurity advisory

Software component issue could grant elevated privileges

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms…

What happened

  • The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the start_comms dispatcher (wps_ic_comms::start_comms), hooked on every front-end request, gates access only by comparing the caller-supplied apikey parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated group, setting, and value parameters directly to change_setting(), which writes them into the WPS_IC_SETTINGS option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing wps_ic_users::checkAndAddCaps() to grant any WordPress role — including Subscriber — the manage_wpc_settings capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the wpc_send_critical_remote nopriv AJAX action: when the external critical-CSS service returns an apiResults field, initCritical() echoes the stored plugin API key back to the caller in a wp_send_json_success response, completing the exploit chain entirely without a WordPress login.Security Advisory CVE-2026-104755
  • The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher (wpsiccomms::startcomms), hooked on every front-end request, gates access only by comparing the…Advisory description (CVE-2026-104755)

Contributing factors stated by the source

  • The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the startcomms dispatcher (wpsiccomms::startcomms), hooked on every front-end request, gates access only by comparing the…

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern