The vulnerability is a missing authorization flaw that permits users to access and manipulate the WP Compress for MainWP plugin’s configuration pages without proper authentication or role checks. This is a CWE‑862 authorization error and can allow an attacker to change compression settings or otherwise disrupt site operation.

Any WordPress site running WP Compress for MainWP plugin version 6.50.17 or earlier. The vulnerability applies to all versions from the product’s initial release up to and including 6.50.17, affecting sites that have installed the plugin without later patching.

The CVSS score of 5.3 indicates moderate severity and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves a user with any authenticated WordPress session interacting with the plugin’s admin interface, potentially leveraging insufficient role restrictions to gain broader control. Given the moderate CVSS and low EPSS, the risk is moderate but not negligible, especially on sites with complex admin structures where lower‑privileged users are commonly granted access.