The WordPress plugin WP Compress has missing capability checks on its AJAX functions in all versions up to and including 6.30.15. Authenticated users with Subscriber level or higher can call these endpoints without proper authorization, allowing them to retrieve, change, or delete plugin configuration and settings. This can expose sensitive information, disrupt the plugin’s operation, degrade site performance, and compromise overall site integrity. The weakness is a missing authorization check, identified as CWE-862.

All installations of the aresit WP Compress – Instant Performance & Speed Optimization plugin, in versions 6.30.15 and earlier, on WordPress sites are affected. No specific WordPress core version is mentioned, so any site running the vulnerable plugin regardless of core version is susceptible.

The vulnerability carries a CVSS score of 8.8, marking it as high severity. EPSS indicates an exploitation probability of less than 1%, suggesting that real‑world attacks have been scarce so far, yet the requirement of only Subscriber‑level authentication makes it an attractive target. The attack vector is through the web, exploiting AJAX endpoints accessible over HTTP; no elevation of privileges or local code execution is needed. The flaw is not currently listed in the CISA KEV catalog, but the missing authorization remains a serious risk for future exploitation.