WP Compress for MainWP suffers from a missing authorization flaw that lets users bypass configured security settings, allowing unauthorized access to plugin controls and potentially the broader WordPress site. The vulnerability is a classic case of broken access control documented as CWE-862, enabling exploitation of improperly configured access control security levels and elevating privileges without proper authorization.

The affected product is the WordPress plugin WP Compress for MainWP. Versions up to and including 6.30.32 are vulnerable. Users hosting WordPress sites with this plugin installed should verify whether the latest version has been applied.

The CVSS score of 5.4 classifies this as a medium severity issue, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker could craft requests that exploit the missing authorization checks or exploit misconfigured access control levels, potentially achieving unauthorized access or privilege escalation.