CVE-2026-120551 Details

A vulnerability exists in the WP Compress – Instant Performance & Speed Optimization plugin for WordPress, in all versions through 7.22.01. The issue stems from the plugin's failure to properly verify user authorization, allowing unauthenticated attackers to link a victim site to an attacker-controlled WP Compress account. Exploitation enables the overwriting of plugin settings to an aggressive live-CDN preset and the acquisition of a shared api_key, which authenticates access to all nopriv HMAC-gated endpoints. This access allows for full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. The vulnerability affects only fresh installations or lite/free-mode installs without a stored api_key, as the sole guard fails open in the absence of a key.

Users are advised to update the WP Compress – Instant Performance & Speed Optimization plugin to version 7.22.38 or a newer patched version.