WP Compress <= 7.26.00 - Authenticated (Administrator+) Missing Authorization to Cross-Site Multisite Settings Modification via 'siteID' Parameter
- ID
- WPSEC-2026-1910
- Plugin
- WP Compress – Instant Performance & Speed Optimization (wp-compress-image-optimizer)
- Affected
- all versions before 7.30.00
- Remediation
- Update to 7.30.00 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Compress on WPSec AttackSurface
- Fix released
- Published
Description
The WP Compress plugin for WordPress is vulnerable to Missing Authorization via the multisite AJAX handlers (the mu_* actions such as mu_save_site_settings, mu_connect_single_site and mu_disconnect_single_site, and wps_ic_cname_add, wps_ic_remove_cname, wps_ic_cname_retry, wps_ic_geolocation and wps_ic_exclude_list) in all versions up to, and including, 7.26.00, due to the handlers checking only the per-site 'manage_wpc_settings' capability and a nonce before calling switch_to_blog() on a user-supplied 'siteID' value or site list. On multisite networks there is no super admin check and no check that the target is the user's own site. This makes it possible for authenticated attackers with administrator-level access to a single sub-site to change the CDN/CNAME configuration, exclusion lists, connection state and plugin settings of other sites in the network.
References
- https://wpsec.com/vuln/WPSEC-2026-1910/
- https://plugins.svn.wordpress.org/wp-compress-image-optimizer/tags/7.30.00/
- https://wordpress.org/plugins/wp-compress-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS