Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by Wordfence

CVE-2026-120551WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters

Medium 5.3

In plain English

A medium-severity missing authorization in WP Compress – Instant Performance & Speed Optimization from aresit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

Affected products (as reported)

VendorProductVersions
aresit WP Compress – Instant Performance & Speed Optimization 0 – through 7.22.01

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References