CVE-2026-120551 | CVSS: 5.3 | 严重级别: MEDIUM
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache inv
参考链接:
• https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21
• https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21
• https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21
📌 数据来源: NVD 官方