{
 "id": "WPSEC-2026-2236",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2236/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2236/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2236/index.md",
 "title": "WP Compress <= 7.30.00 - Unauthenticated Sensitive Information Exposure via Cache Purge Log File",
 "description": "The WP Compress plugin for WordPress is vulnerable to Sensitive Information Exposure via the cache purge log in all versions up to, and including, 7.30.00, due to the plugin writing the complete old and new plugin options, including the WP Compress API key, unmasked to a predictable, publicly accessible file at wp-content/cachePurging.txt whenever a cache purge happens while the plugin's debug log is enabled. This makes it possible for unauthenticated attackers to download the file and obtain the site's WP Compress API key and other plugin configuration, on sites where an administrator has enabled the debug log.",
 "plugin": {
  "slug": "wp-compress-image-optimizer",
  "name": "WP Compress",
  "full_name": "WP Compress – Instant Performance & Speed Optimization",
  "wordpress_org": "https://wordpress.org/plugins/wp-compress-image-optimizer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-compress-image-optimizer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-compress-image-optimizer"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.30.30",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.30.30"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.30.30",
 "remediation": "Update to 7.30.30 or later.",
 "fix_released": "2026-10-30T20:57:55+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:52.167405+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2236/",
  "https://plugins.svn.wordpress.org/wp-compress-image-optimizer/tags/7.30.30/",
  "https://wordpress.org/plugins/wp-compress-image-optimizer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-compress-image-optimizer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}